77

I'm looking to list all ports a PID is currently listening on.

How would you recommend I get this kind of data about a process?

| improve this question | |
  • Weird enough ss has no filtering on PID except for netlink sockets. – poige Oct 25 '18 at 4:38
69

You can use ss from the iproute2 package (which is similar to netstat):

ss -l -p -n | grep "pid=1234,"

or (for older iproute2 version):

ss -l -p -n | grep ",1234,"

Replace 1234 with the PID of the program.

| improve this answer | |
  • 3
    There is also -u or -t for udb or tcp only. :+1: And these can all be stacked like so: ss -tlnp, And to eliminate fill width output, which I find annoying you can pipe though cat or less or w/e: ss -tlnp | cat – ThorSummoner Oct 6 '15 at 17:53
  • 1
    I've gotten into the habit ss -nlp | cat, that's roughly, show me listening processes (-l), their port numbers (-n), and their process info (-p), and don't try to fit the output to my shell | cat (or less or whatever). Only took me two years to get used to that :D – ThorSummoner Jul 9 '16 at 21:48
  • Didn't work for me (on Debian 9). There you need to grep for ",pid=1234," – ofrommel Nov 9 '18 at 10:44
  • @ofrommel thanks for the hint - I adapted the answer. – jofel Nov 27 '18 at 11:40
  • Also, this does only work with root permissions :) – ofrommel Nov 30 '18 at 17:28
64

I am not aware of a way using iproute2 tools. But as a workaround, you could try this one out. 

lsof -Pan -p PID -i

should give you the information you are looking for.

Output

lsof -Pan -p 27808 -i
COMMAND   PID   USER   FD   TYPE    DEVICE SIZE/OFF NODE NAME
httpd   27808 apache    5u  IPv6 112811294      0t0  TCP *:80 (LISTEN)
httpd   27808 apache    7u  IPv6 112811298      0t0  TCP *:8443 (LISTEN)
httpd   27808 apache    9u  IPv6 112811303      0t0  TCP *:443 (LISTEN)

I got this command from here but not sure of the exact link since I have all of them noted down in the notebook. But you could check out from there as well.

| improve this answer | |
15

You can use netstat for this to figure out pid of each listen process.

netstat - Print network connections, routing tables, interface statistics, masquerade connections, and multicast memberships

-a, --all Show both listening and non-listening (for TCP this means established connections) sockets. With the --interfaces option, show interfaces that are not marked

--numeric , -n Show numerical addresses instead of trying to determine symbolic host, port or user names.

-p, --program Show the PID and name of the program to which each socket belongs.

Here is an example:

# netstat -anp
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address               Foreign Address             State       PID/Program name
tcp        0      0 0.0.0.0:111                 0.0.0.0:*                   LISTEN      1507/rpcbind
tcp        0      0 0.0.0.0:51188               0.0.0.0:*                   LISTEN      1651/rpc.statd
tcp        0      0 0.0.0.0:1013                0.0.0.0:*                   LISTEN      1680/ypbind
tcp        0      0 0.0.0.0:22                  0.0.0.0:*                   LISTEN      1975/sshd
tcp        0      0 127.0.0.1:631               0.0.0.0:*                   LISTEN      1763/cupsd
tcp        0      0 127.0.0.1:25                0.0.0.0:*                   LISTEN      2081/master
tcp        0      0 127.0.0.1:27017             0.0.0.0:*                   LISTEN      2119/mongod
tcp        0     48 172.16.33.73:22             172.16.127.110:51850        ESTABLISHED 25473/sshd
tcp        0      0 172.16.33.73:22             172.16.127.110:51214        ESTABLISHED 24699/sshd
tcp        0      0 :::111                      :::*                        LISTEN      1507/rpcbind
tcp        0      0 :::9200                     :::*                        LISTEN      1994/java
tcp        0      0 :::9300                     :::*                        LISTEN      1994/java
tcp        0      0 :::22                       :::*                        LISTEN      1975/sshd
tcp        0      0 ::1:631                     :::*                        LISTEN      1763/cupsd
tcp        0      0 ::1:25                      :::*                        LISTEN      2081/master
tcp        0      0 :::59162                    :::*                        LISTEN      1651/rpc.statd
| improve this answer | |
  • 1
    Thank you though I've been informed that netstat has been deprecated by iproute2 tools and I'm looking to avoid it. – ThorSummoner Sep 27 '14 at 6:45
13

@jofel's answer shows you the appropriate tool to use, ss, here's the replacements for the other networking tools in iproute2.

The deprecated commands and their iproute2 equivalents are as follows:

deprecated      replacement(s)
==========      ==============
- arp           ip n (ip neighbor)
- ifconfig      ip a (ip addr), ip link, ip -s (ip -stats)
- iptunnel      ip tunnel
- iwconfig      iw
- nameif        ip link, ifrename
- netstat       ss, ip route (for netstat-r), ip -s link (for netstat -i), 
                ip maddr (for netstat-g)

- route         ip r (ip route)

The basic list is also here on Wikipedia: http://en.wikipedia.org/wiki/Iproute2.

References

| improve this answer | |
2

Another method for lsof if you don't know the PID, but just the name of the Program:

lsof -Pa -p $(pgrep [programName]) -i
| improve this answer | |
  • doesn't work with lsof 4.89 on ubuntu 16.04 – palik Dec 12 '18 at 11:12
  • 1
    That will be the case if the program has spawned multiple processes.which in that case you will need to specify the specific PID when running the lsof command I gave. pgrep <program name> then choose the PID you need for the above command. replacing $(pgrep [programName]) with the PID# – cryptoboy Dec 12 '18 at 15:21
1

Have you tried, this also does same 

netstat -plnt | grep 27071

success

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.