On my CentOS 7, at one point,
sudo ss -plt listed a port marked as LISTENING on
*:30565, but there was no information whatsoever in the process column of its row. The other listening ports were showing their owning process as usual, like
users:(("sshd",pid=1381,fd=3)), but that one row did not have any process information.
lsof -i :30565 or
netstat -p did not yeld any information either.
I haven't been able to reproduce this, and i struggle to think of a situation a "non-process" might be listening on a port (as i'm quite sure Linux does the intended cleanup work when a tcp-listening proess dies). As it happens with multiple programs too, the only explanation I can think of is that this is an "intended but very rootkit-y" behaviour of CentOS, but i'm most surely missing something. What might possibly have caused this?