On my CentOS 7, at one point,
sudo ss -plt listed a port marked as LISTENING on
*:30565, but there was no information whatsoever in the process column of its row. The other listening ports were showing their owning process as usual, like
users:(("sshd",pid=1381,fd=3)), but that one row did not have any process information.
lsof -i :30565 or
netstat -p did not yield any information either.
I haven't been able to reproduce this, and I struggle to think of a situation a "non-process" might be listening on a port (as I'm quite sure Linux does the intended cleanup work when a tcp-listening process dies). As it happens with multiple programs too, the only explanation I can think of is that this is an "intended but very rootkit-y" behaviour of CentOS, but I'm most surely missing something. What might possibly have caused this?