1

after logging into a server, I used netstat to check out the ports of this server and wanted to find which port was communicating with me

My IP is 143.248.143.198 and my search results are like below:

[kwagjj@James5 ~]$ netstat | grep 143.248.143.198
tcp        0     52 James5:smakynet             143.248.143.198:49690       ESTABLISHED
[kwagjj@James5 ~]$ netstat | smakynet
smakynet: Command not found.
[kwagjj@James5 ~]$ netstat | grep smakynet
tcp        0      0 James5:smakynet             143.248.143.199:49573       ESTABLISHED
tcp        0      0 James5:smakynet             143.248.143.198:49690       ESTABLISHED
tcp        0      0 James5:smakynet             143.248.143.212:51070       ESTABLISHED
tcp        0      0 James5:smakynet             143.248.143.210:9693        ESTABLISHED
tcp        0      0 James5:smakynet             143.248.143.217:azeti       ESTABLISHED
tcp        0      0 James5:smakynet             143.248.143.216:51892       ESTABLISHED
tcp        0      0 James5:smakynet             143.248.143.210:10599       ESTABLISHED

I tried to see if James5:smakynet lead to some other port but it looks like my side of the port is only communicating with 'James5:smakynet'.

Does anyone know what this 'smakynet' is? What does this do? I googled it but it didn't give me any proper info.

2

Whenever you do not recognize a port by name, you can grep for the name in /etc/services to see that the name is defined there. On my Linux systems, smakynet is TCP/UDP 122.

grep smakynet /etc/services

Use man netstat to learn about which switches can be used to reveal more information. In this case, use switches that will help find more information about process IDs.

netstat -tulpn | grep smakynet

Now you can see which process uses the port. You will get output like the following example.

tcp 0 0 127.0.0.1:631 0.0.0.0:* LISTEN 1565/cupsd

Above, cupsd was opened with PID 1565; it is using TCP port 631.

This should help to identify which program is using the port. I do not know why smakynet is listed in /etc/services; though, to hazard a guess, it could be an ancient protocol or perhaps it was registered with IANA and never developed.

So, which program did you find that uses the smakynet port on which O/S?

2

It's generally more useful to run netstat with the -n and -p switches so that you can see what process is listening or using a given port in the netstat output.

Example

$ sudo netstat -anpt
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address               Foreign Address             State       PID/Program name   
tcp        0      0 0.0.0.0:111                 0.0.0.0:*                   LISTEN      1406/rpcbind        
tcp        0      0 0.0.0.0:80                  0.0.0.0:*                   LISTEN      13203/nginx         
tcp        0      0 0.0.0.0:22                  0.0.0.0:*                   LISTEN      1628/sshd           
tcp        0      0 127.0.0.1:631               0.0.0.0:*                   LISTEN      1506/cupsd          
tcp        0      0 127.0.0.1:25                0.0.0.0:*                   LISTEN      1712/master         
tcp        0      0 0.0.0.0:443                 0.0.0.0:*                   LISTEN      13203/nginx         
tcp        0      0 0.0.0.0:35171               0.0.0.0:*                   LISTEN      1424/rpc.statd      
tcp        0      0 192.168.1.228:80            209.190.113.82:36019        ESTABLISHED 13307/nginx         
tcp        0      0 192.168.1.228:80            192.168.1.1:58845           TIME_WAIT   -                   
tcp        0      0 192.168.1.228:22            192.168.1.7:52418           ESTABLISHED 2382/sshd           
tcp        0      0 192.168.1.228:443           209.190.113.82:46600        TIME_WAIT   -                   
tcp        0      0 :::111                      :::*                        LISTEN      1406/rpcbind        
tcp        0      0 :::22                       :::*                        LISTEN      1628/sshd           
tcp        0      0 ::1:631                     :::*                        LISTEN      1506/cupsd          
tcp        0      0 ::1:25                      :::*                        LISTEN      1712/master         
tcp        0      0 :::37115                    :::*                        LISTEN      1424/rpc.statd      

Here we can see that ports 80 & 443 are in use by a process, nginx on 2 interfaces, 0.0.0.0 and 192.168.1.228. The 2nd IP is the one associated with the Ethernet port on this system, and the IP 0.0.0.0 is special, denoting that the server daemon, nginx, will bind to any and all interfaces that are present on the box.

Network interfaces

$ ip addr show
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue state UNKNOWN 
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 54:52:00:ff:ff:f1 brd ff:ff:ff:ff:ff:ff
    inet 192.168.1.228/24 brd 192.168.1.255 scope global eth0
    inet6 fe80::5652:ff:feff:fff1/64 scope link 
       valid_lft forever preferred_lft forever
  • thanks! this answer was also helpful :) pity I couldn't use the -p switch since I don't have the authority :( – kwagjj Jun 18 '14 at 8:06
  • @kwagjj - you can use the -p switch but it will only show you processes that you're the owner. – slm Jun 18 '14 at 11:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.