I'm looking to list all ports a PID is currently listening on.
How would you recommend I get this kind of data about a process?
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It only takes a minute to sign up.
Sign up to join this communityI'm looking to list all ports a PID is currently listening on.
How would you recommend I get this kind of data about a process?
You can use ss
from the iproute2 package (which is similar to netstat
):
ss -l -p -n | grep "pid=1234,"
or (for older iproute2 version):
ss -l -p -n | grep ",1234,"
Replace 1234 with the PID of the program.
-u
or -t
for udb or tcp only. :+1: And these can all be stacked like so: ss -tlnp
, And to eliminate fill width output, which I find annoying you can pipe though cat or less or w/e: ss -tlnp | cat
– ThorSummoner
Oct 6 '15 at 17:53
ss -nlp | cat
, that's roughly, show me listening processes (-l), their port numbers (-n), and their process info (-p), and don't try to fit the output to my shell | cat
(or less or whatever). Only took me two years to get used to that :D
– ThorSummoner
Jul 9 '16 at 21:48
I am not aware of a way using iproute2
tools. But as a workaround, you could try this one out.
lsof -Pan -p PID -i
should give you the information you are looking for.
Output
lsof -Pan -p 27808 -i
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
httpd 27808 apache 5u IPv6 112811294 0t0 TCP *:80 (LISTEN)
httpd 27808 apache 7u IPv6 112811298 0t0 TCP *:8443 (LISTEN)
httpd 27808 apache 9u IPv6 112811303 0t0 TCP *:443 (LISTEN)
I got this command from here but not sure of the exact link since I have all of them noted down in the notebook. But you could check out from there as well.
You can use netstat
for this to figure out pid of each listen process.
netstat - Print network connections, routing tables, interface statistics, masquerade connections, and multicast memberships
-a, --all Show both listening and non-listening (for TCP this means established connections) sockets. With the --interfaces option, show interfaces that are not marked
--numeric , -n Show numerical addresses instead of trying to determine symbolic host, port or user names.
-p, --program Show the PID and name of the program to which each socket belongs.
Here is an example:
# netstat -anp
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 0.0.0.0:111 0.0.0.0:* LISTEN 1507/rpcbind
tcp 0 0 0.0.0.0:51188 0.0.0.0:* LISTEN 1651/rpc.statd
tcp 0 0 0.0.0.0:1013 0.0.0.0:* LISTEN 1680/ypbind
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 1975/sshd
tcp 0 0 127.0.0.1:631 0.0.0.0:* LISTEN 1763/cupsd
tcp 0 0 127.0.0.1:25 0.0.0.0:* LISTEN 2081/master
tcp 0 0 127.0.0.1:27017 0.0.0.0:* LISTEN 2119/mongod
tcp 0 48 172.16.33.73:22 172.16.127.110:51850 ESTABLISHED 25473/sshd
tcp 0 0 172.16.33.73:22 172.16.127.110:51214 ESTABLISHED 24699/sshd
tcp 0 0 :::111 :::* LISTEN 1507/rpcbind
tcp 0 0 :::9200 :::* LISTEN 1994/java
tcp 0 0 :::9300 :::* LISTEN 1994/java
tcp 0 0 :::22 :::* LISTEN 1975/sshd
tcp 0 0 ::1:631 :::* LISTEN 1763/cupsd
tcp 0 0 ::1:25 :::* LISTEN 2081/master
tcp 0 0 :::59162 :::* LISTEN 1651/rpc.statd
netstat
has been deprecated by iproute2 tools and I'm looking to avoid it.
– ThorSummoner
Sep 27 '14 at 6:45
@jofel's answer shows you the appropriate tool to use, ss
, here's the replacements for the other networking tools in iproute2.
The deprecated commands and their iproute2 equivalents are as follows:
deprecated replacement(s)
========== ==============
- arp ip n (ip neighbor)
- ifconfig ip a (ip addr), ip link, ip -s (ip -stats)
- iptunnel ip tunnel
- iwconfig iw
- nameif ip link, ifrename
- netstat ss, ip route (for netstat-r), ip -s link (for netstat -i),
ip maddr (for netstat-g)
- route ip r (ip route)
The basic list is also here on Wikipedia: http://en.wikipedia.org/wiki/Iproute2.
Another method for lsof
if you don't know the PID, but just the name of the Program:
lsof -Pa -p $(pgrep [programName]) -i
pgrep <program name>
then choose the PID you need for the above command. replacing $(pgrep [programName])
with the PID#
– cryptoboy
Dec 12 '18 at 15:21
ss
has no filtering on PID except for netlink sockets. – poige Oct 25 '18 at 4:38