Tag Info

Hot answers tagged

23

You can use netstat's -p option. You're already issuing it, but to get process information, you need to be the superuser: $ sudo netstat -nlp | grep 80 tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN 125004/nginx


16

Using lsof (as root): # lsof -i -n -P COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME sshd 3028 root 3u IPv4 7072 0t0 TCP *:22 (LISTEN) sshd 3028 root 4u IPv6 7074 0t0 TCP *:22 (LISTEN) iproute2's ss can do this, too (as root): # ss -lp State Recv-Q Send-Q Local Address:Port ...


11

(you might have to install the package ip on openwrt (v12 / attitude adjustment) ifconfig/netstat etc. are considered deprecated, so you should use (as root) ss -nlput | grep sshd to show the TCP/UDP sockets on which a running program which contains the string sshd is listening to -nno port to name resolution -lonly listening sockets -pshow processes ...


10

Yes you can. Download it. But as you don't say what flavor of linux re you using here is couple of examples: Debian/Ubuntu related: # What package is the netstat executable in? apt-file search /usr/bin/netstat # Now download the source of that package apt-get source net-tools CentOS/Red Hat: yumdownloader --source net-tools


10

Two ways: lsof -i :port -S netstat -a | grep port You can do man lsof or man netstat for the needed info. Replace port by the port number you want to search for.


10

Also you can use lsof utility. Need to be root. # lsof -i :25 COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME exim4 2799 Debian-exim 3u IPv4 6645 0t0 TCP localhost:smtp (LISTEN) exim4 2799 Debian-exim 4u IPv6 6646 0t0 TCP localhost:smtp (LISTEN)


9

As recommended by IBM: use lsof -i -n and look for port XY. If you want parseable output from lsof, use the -F flag and parse the output with awk. You can get pre-compiled binaries for AIX V5. I don't know if there are pre-compiled binaries for V6; if there aren't, get the source and compile it.


8

One way is to say lsof -i:57010 -sTCP:ESTABLISHED. This walks the kernel's open file handle table looking for processes with an established TCP connection using that port. (Network sockets are file handles on *ix type systems.) You'd use -sTCP:LISTEN on the server side to filter out only the listener socket instead. Because of the way lsof works, it can ...


8

You can use netstat -anp | grep 57010 on server C. But this will only work if there isn't any firewall in between which is mapping port 57010 to a different one.


8

My solution is to bind to port 0, which asks the kernel to allocate a port from it's ip_local_port_range. Then, close the socket and use that port number in your configuration. This works because the kernel doesn't seem to reuse port numbers until it absolutely has to. Subsequent binds to port 0 will allocate a different port number. Python code: import ...


7

Another alternative is to simply test the exit status of grep itself, which will return false (1) if there was no match and true (0) if there was one, by not using the [ command. if netstat -lntp | grep ':8080.*java' > /dev/null; then echo "Found a Tomcat!" fi The redirection to /dev/null is to prevent it from also printing the found line to the ...


7

Use the bash [[ conditional construct and prefer the $(<command>) command substitution convention. Additionally, [[ prevents word splitting of variable values therefore there is no need to quote the command substitution bit.. if [[ $(netstat -lnp | grep ':8080') == *java* ]]; then echo "Found a Tomcat!" fi


7

strace -e trace=connect -f yourprogram or using a dump file strace -o yourprogram.strace -e trace=connect -f yourprogram


6

The script in your answer has a race condition, the only way to avoid it is to atomically check if it is open by trying to open it. If the port is in use, the program should quit with a failure to open the port. For example, say you're trying to listen with netcat. #!/bin/bash read lowerPort upperPort < /proc/sys/net/ipv4/ip_local_port_range while :; do ...


5

How (where) can I find out information about them, First you have to find out which program is bound to each port. Unfortunately, there is no single standard way to do that which will work on all *ix type systems, and your question doesn't specify one. Some versions of netstat have a flag which will include the associated program name on each output ...


5

You can use fuser or lsof i.e: fuser 8453/tcp lsof -i TCP:8453 If you want more information from fuser you can also use the -v flag, i.e: fuser -v 8453/tcp


5

By default sshd uses ipv4 and ipv6. You can configure the protocol sshd uses through the AddressFamily directive in /etc/ssh/sshd_config For ipv4 & ipv6 (default) AddressFamily any For ipv4 only AddressFamily inet For ipv6 only AddressFamily inet6 After you make any changes to sshd_config restart sshd for the changes to take effect.


4

Just for the sake of completeness: Using ss from the new Linux networking utility tool-set (iproute2): ss -tp sport = :57010 dst 192.168.1.220


4

Try using netstat with rmsock. port=$1 addr=`netstat -Aan | grep $port | awk '{print $1}` pid=`rmsock $addr tcpcb | awk '{print $9}'` ps -ef | grep $pid For netstat, the -A shows the address of any protocol control blocks associated with the sockets, the -a option shows the state of all sockets including those of server processes, and the -n option gives ...


4

for what its worth... depending on the version of netstat (specifically GNU netstat) you have, you can use netstat -punta | grep <port> this will show you connections in ESTABLISHED and LISTEN states UDP and TCP and it will ignore the UNIX local sockets. the end result is a nice, neat, small result set. the -p flag will give you the process ID ...


4

The man pages are your friends for info such as this: $ man netstat ... SYNOPSIS netstat [address_family_options] [--tcp|-t] [--udp|-u] ... Notice in the usage that those switches are the short forms of the GNU style switches --tcp and --udp.


4

You can use sort to reorganize the output of netstat in any format you like. $ netstat -anpt 2>&1 | tail -n +5 | sort -k7,7 -k 6,6 This will sort the output using the 7th column first (the process name/PID) followed by the state (ESTABLISHED, LISTEN, etc.). NOTE: The first part of the command, netstat -anpt 2>&1 | tail -n +5 .. will direct ...


4

One specific script, no, but there is a way to get that information. Several ways, probably. I would start with netstat -tuln, which will tell you what ports have listening services associated with them. You can then look at things like fuser -n tcp <port num> to tell what PID(s) is/are listening to a given port, which can then tell you what daemon / ...


4

I think the clue is in the port numbers, take these two entries smtpd 12950 postfix 9u IPv4 35762406 0t0 TCP hostname:smtp->spe.cif.ic.IP:55277 (ESTABLISHED) smtp 13007 postfix 13u IPv4 35762309 0t0 TCP hostname:34434->fake.VVVVV.fr:smtp (ESTABLISHED) smtpd has received a connection on port smtp(25) from a high port number, ...


4

On Linux at least, lsof can't tell you which end initiated the connection as it gets the list from /proc/net/tcp where that information is not available. The first address always refers to the local endpoint. Recent versions of the ss utility (which use a different kernel API to retrieve connection information), with -e, will give you direction but ...


3

netstat is part of the net-tools suite. The project home page is here: https://sourceforge.net/projects/net-tools/ You can browse the netstat source here: http://sourceforge.net/p/net-tools/code/ci/master/tree/ or view the netstat.c file.


3

On Linux, you can set up the audit subsystem to log every attempt to establish a network connection. For information about the audit subsystem, read the auditctl man page or this tutorial or other examples on this site. Install your distribution's auditd package if necessary, then auditctl -A exit,always -S connect


3

If you're able to install a custom kernel, you should have a look at SystemTap. There are plenty of examples how to trace network activity.


3

tcp6 simply means TCP protocol over IP v6. tcp6 0 0 dmz.local.net:www 5.140.235.6%14631:49964 ESTABLISHED 21393/apache2 As from the netstat manual: tcp6: The protocol used. Here it is TCP over IPv6 0: The count of bytes not copied by the user program connected to this socket. 0: The count of bytes not acknowledged by the remote host. Local Address ...


3

Your mistake is that you're associating the information on the netstat output with the interface rather than the destination. Destination addresses can have associated gateways. When you configure your network, you're associating interfaces and gateways with sets of destination addresses -- so the question you need to be asking is "what's the gateway for ...



Only top voted, non community-wiki answers of a minimum length are eligible