On my CentOS 7, at one point, sudo ss -plt listed a port marked as LISTENING on *:30565, but there was no information whatsoever in the process column of its row. The other listening ports were showing their owning process as usual, like users:(("sshd",pid=1381,fd=3)), but that one row did not have any process information. lsof -i :30565 or netstat -p did not yield any information either.

I haven't been able to reproduce this, and I struggle to think of a situation a "non-process" might be listening on a port (as I'm quite sure Linux does the intended cleanup work when a tcp-listening process dies). As it happens with multiple programs too, the only explanation I can think of is that this is an "intended but very rootkit-y" behaviour of CentOS, but I'm most surely missing something. What might possibly have caused this?

  • Are you sure it was seen using sudo/root? Nov 27 '16 at 14:47
  • Absolutely. ss -p without sudo would not show any process information on any row of the output, while with sudo i would see process information on every row but the one i mentioned. Nov 27 '16 at 14:50
  • Do you by chance use NFS? Nov 27 '16 at 14:52
  • I do occasionally, and given your question i have just tried starting the nfs-server process, and reproduced the problem!! What's up here? Nov 27 '16 at 14:56
  • Welcome to Unix and Linux and congratulations for your first question btw. Nov 27 '16 at 15:54

The point on netstat not showing the process information on some situations, for instance NFS, is that NFS is a kernel module, and as such, it does not run as a normal process, and does not have a PID.

You can regularly find threads about this situation if including NFS on your google searches:

netstat doesn't report PID/Program name for some ports

  • 2
    It makes sense, thank you. It would have been nice of the netstat/ss/lsof tools (or their manuals) to give some more information on this matter Nov 27 '16 at 15:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.