1

I'm diagnosing an old Solaris 10 build and during port scans I've found an open port that's not on the approved list for this server.

I've tried various combinations of netstat switches but I can't seem to get the right output that gives me the associated service name or PID of the open port.

The feature set of netstat on this build seems to be limited compared to later solaris versions and other unix operating systems. netstat -tulpn for example doesn't work.

I also can't install lsof due to security restrictions.

Any ideas?

  • 2
    Ironic that a security scan uncovers an issue that is made more difficult to resolve by a separate security restriction! – Jeff Schaller Oct 13 '16 at 11:08
  • You're telling me! The environment is heavily restricted so I have to work with what's on the box. – popcornuk Oct 13 '16 at 11:11
7

For Solaris you can use pfiles <pid> to see which network ports are opened by a certain process. Using a for-loop on /proc/* you can use pfiles on each running process to lookup the port you are after. Drawback is that you will need to be root on Solaris 10, or be able to become privileged (pfexec pfiles) on Solaris 11 to get the info.

If you are able to become root on the Solaris host you should be able to use something like:

PORT=22; for PID in /proc/*; do pfiles ${PID} |grep "port: ${PORT}" && echo ${PID}; done

This will iterate through /proc/*, filter for the specified port and if a match is found, the process ID (/proc/####) is shown on the next line.

  • Thank you this worked. I had to change the grep string slightly to include 2 space chars so ended up with " port: ${PORT}" – popcornuk Oct 13 '16 at 18:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.