3

On my CentOS 7, at one point, sudo ss -plt listed a port marked as LISTENING on *:30565, but there was no information whatsoever in the process column of its row. The other listening ports were showing their owning process as usual, like users:(("sshd",pid=1381,fd=3)), but that one row did not have any process information. lsof -i :30565 or netstat -p did not yeld any information either.

I haven't been able to reproduce this, and i struggle to think of a situation a "non-process" might be listening on a port (as i'm quite sure Linux does the intended cleanup work when a tcp-listening proess dies). As it happens with multiple programs too, the only explanation I can think of is that this is an "intended but very rootkit-y" behaviour of CentOS, but i'm most surely missing something. What might possibly have caused this?

  • Are you sure it was seen using sudo/root? – Rui F Ribeiro Nov 27 '16 at 14:47
  • Absolutely. ss -p without sudo would not show any process information on any row of the output, while with sudo i would see process information on every row but the one i mentioned. – Mario Vitale Nov 27 '16 at 14:50
  • Do you by chance use NFS? – Rui F Ribeiro Nov 27 '16 at 14:52
  • I do occasionally, and given your question i have just tried starting the nfs-server process, and reproduced the problem!! What's up here? – Mario Vitale Nov 27 '16 at 14:56
  • Welcome to Unix and Linux and congratulations for your first question btw. – Rui F Ribeiro Nov 27 '16 at 15:54
3

The point on netstat not showing the process information on some situations, for instance NFS, is that NFS is a kernel module, and as such, it does not run as a normal process, and does not have a PID.

You can find regularly threads about this situation if including NFS on your google searchs:

netstat doesn't report PID/Program name for some ports

  • 1
    It makes sense, thank you. It would have been nice of the netstat/ss/lsof tools (or their manuals) to give some more information on this matter – Mario Vitale Nov 27 '16 at 15:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.