What process is listening on a port?

Question

[root@SERVER ~]# netstat -tulpn | grep 44316
tcp        0      0 :::44316                    :::*                        LISTEN      -                   
[root@SERVER ~]# lsof -i | grep 44316
[root@SERVER ~]# rpcinfo
   program version netid     address                service    owner
    100000    4    tcp6      ::.0.111               portmapper superuser
    100000    3    tcp6      ::.0.111               portmapper superuser
    100000    4    udp6      ::.0.111               portmapper superuser
    100000    3    udp6      ::.0.111               portmapper superuser
    100000    4    tcp       0.0.0.0.0.111          portmapper superuser
    100000    3    tcp       0.0.0.0.0.111          portmapper superuser
    100000    2    tcp       0.0.0.0.0.111          portmapper superuser
    100000    4    udp       0.0.0.0.0.111          portmapper superuser
    100000    3    udp       0.0.0.0.0.111          portmapper superuser
    100000    2    udp       0.0.0.0.0.111          portmapper superuser
    100000    4    local     /var/run/rpcbind.sock  portmapper superuser
    100000    3    local     /var/run/rpcbind.sock  portmapper superuser
    100024    1    udp       0.0.0.0.182.78         status     29
    100024    1    tcp       0.0.0.0.233.28         status     29
    100024    1    udp6      ::.211.157             status     29
    100024    1    tcp6      ::.149.214             status     29
    100021    1    udp       0.0.0.0.214.72         nlockmgr   superuser
    100021    3    udp       0.0.0.0.214.72         nlockmgr   superuser
    100021    4    udp       0.0.0.0.214.72         nlockmgr   superuser
    100021    1    tcp       0.0.0.0.208.233        nlockmgr   superuser
    100021    3    tcp       0.0.0.0.208.233        nlockmgr   superuser
    100021    4    tcp       0.0.0.0.208.233        nlockmgr   superuser
    100021    1    udp6      ::.236.54              nlockmgr   superuser
    100021    3    udp6      ::.236.54              nlockmgr   superuser
    100021    4    udp6      ::.236.54              nlockmgr   superuser
    100021    1    tcp6      ::.173.28              nlockmgr   superuser
    100021    3    tcp6      ::.173.28              nlockmgr   superuser
    100021    4    tcp6      ::.173.28              nlockmgr   superuser
    100011    1    udp       0.0.0.0.3.107          rquotad    superuser
    100011    2    udp       0.0.0.0.3.107          rquotad    superuser
    100011    1    tcp       0.0.0.0.3.107          rquotad    superuser
    100011    2    tcp       0.0.0.0.3.107          rquotad    superuser
    100005    1    udp       0.0.0.0.168.181        mountd     superuser
    100005    1    tcp       0.0.0.0.227.100        mountd     superuser
    100005    1    udp6      ::.156.16              mountd     superuser
    100005    1    tcp6      ::.221.194             mountd     superuser
    100005    2    udp       0.0.0.0.164.189        mountd     superuser
    100005    2    tcp       0.0.0.0.184.174        mountd     superuser
    100005    2    udp6      ::.139.191             mountd     superuser
    100005    2    tcp6      ::.234.54              mountd     superuser
    100005    3    udp       0.0.0.0.151.108        mountd     superuser
    100005    3    tcp       0.0.0.0.219.117        mountd     superuser
    100005    3    udp6      ::.177.166             mountd     superuser
    100005    3    tcp6      ::.216.151             mountd     superuser
    100003    2    tcp       0.0.0.0.8.1            nfs        superuser
    100003    3    tcp       0.0.0.0.8.1            nfs        superuser
    100003    4    tcp       0.0.0.0.8.1            nfs        superuser
    100227    2    tcp       0.0.0.0.8.1            nfs_acl    superuser
    100227    3    tcp       0.0.0.0.8.1            nfs_acl    superuser
    100003    2    udp       0.0.0.0.8.1            nfs        superuser
    100003    3    udp       0.0.0.0.8.1            nfs        superuser
    100003    4    udp       0.0.0.0.8.1            nfs        superuser
    100227    2    udp       0.0.0.0.8.1            nfs_acl    superuser
    100227    3    udp       0.0.0.0.8.1            nfs_acl    superuser
    100003    2    tcp6      ::.8.1                 nfs        superuser
    100003    3    tcp6      ::.8.1                 nfs        superuser
    100003    4    tcp6      ::.8.1                 nfs        superuser
    100227    2    tcp6      ::.8.1                 nfs_acl    superuser
    100227    3    tcp6      ::.8.1                 nfs_acl    superuser
    100003    2    udp6      ::.8.1                 nfs        superuser
    100003    3    udp6      ::.8.1                 nfs        superuser
    100003    4    udp6      ::.8.1                 nfs        superuser
    100227    2    udp6      ::.8.1                 nfs_acl    superuser
    100227    3    udp6      ::.8.1                 nfs_acl    superuser
[root@SERVER ~]# netstat --program --numeric-hosts --numeric-ports --extend | grep 44316
[root@SERVER ~]# lsb_release -a
LSB Version:    :base-4.0-amd64:base-4.0-noarch:core-4.0-amd64:core-4.0-noarch:graphics-4.0-amd64:graphics-4.0-noarch:printing-4.0-amd64:printing-4.0-noarch
Distributor ID: RedHatEnterpriseServer
Description:    Red Hat Enterprise Linux Server release 6.7 (Santiago)
Release:    6.7
Codename:   Santiago
[root@SERVER ~]#

Question: What is 44316 used for? Is it some kind of kernel process? But what?

There were already topics on these, but as you can see, none of the solutions show what is it used for.

UPDATE:

[root@SERVER ~]# lsof -i :44316 -S
[root@SERVER ~]# netstat -a | grep 44316
tcp        0      0 *:44316                     *:*                         LISTEN      
[root@SERVER ~]# fuser 44316/tcp
[root@SERVER ~]# echo $?
1
[root@SERVER ~]# ss -ap | grep 44316
LISTEN     0      64                     :::44316                   :::*       
[root@SERVER ~]# telnet localhost 44316
Trying ::1...
Connected to localhost.
Escape character is '^]'.
test
Connection closed by foreign host.
[root@SERVER ~]#

After days, it is still listening!

Have you seen this one? unix.stackexchange.com/questions/9252/… — George Vasiliou, Apr 10 '17 at 14:08
The duplicate question covers 'netstat - ...p' but doesn't explain why your output has a dash instead of a program name. The duplicate question also indicates using 'lsof', which is empty in your case. Since you appear to be running as root, I'm voting to leave this Q independent. — Jeff Schaller♦, Apr 10 '17 at 15:18
@JeffSchaller This seems to be correct. I've retracted my initial vote. — Kusalananda♦, Apr 10 '17 at 15:39
If you repeat the netstat -tulpn | grep 44316 command, do you still get the same output? It seems as though a process may have exited. — Jeff Schaller♦, Apr 10 '17 at 17:43
I updated the question with further checks, it is still unkown! — Marina Ala, Apr 11 '17 at 6:32

Community · Accepted Answer · 2017-04-13 12:13:51Z

2

44316 is a port number (more than likely) from the ephemeral range.

The process might be transient and have disappeared from the /proc hierarchy preventing netstat to identify it.

Otherwise, there are reports telling that a kernel module is able to listen to a port without a specific process showing up, but I haven't yet observed this.

edited Apr 13 '17 at 12:13

Community♦

1

answered Apr 10 '17 at 15:37

jlliagre

49.6k9 gold badges91 silver badges142 bronze badges

44316 may or may not be from the ephemeral range. You would have to check the current value of /proc/sys/net/ipv4/ip_local_port_range. – fpmurphy Apr 10 '17 at 16:12
@fpmurphy1 Technically, you are right so I've updated my answer. It is however very unlikely for the OP server to be configured that way. – jlliagre Apr 10 '17 at 16:15
I updated the question with further checks, it is still unkown! – Marina Ala Apr 11 '17 at 6:31
Next step would be to see what kernel tracing tool are available on your machine and use them to identify what is listening on this port. See this page for a description of various tools. – jlliagre Apr 11 '17 at 8:25

add a comment |

Ayush Goyal · Accepted Answer · 2017-04-10 16:20:10Z

1

Try one of these:

lsof -i :44316 -S
netstat -a | grep 44316

To find out the processes PID that opened tcp port 44316, enter:

fuser 44316/tcp

answered Apr 10 '17 at 16:20

Ayush Goyal

2991 gold badge3 silver badges9 bronze badges

I updated the question with further checks, it is still unkown! – Marina Ala Apr 11 '17 at 6:31

add a comment |

Paranoid · Accepted Answer · 2017-08-08 09:28:00Z

Found this question when trying to resolve a similar problem on my system.

It turned out in my case the socket had been opened for an nfsv4 callback daemon and since all of this is performed in kernel modules there is no process associated with the open socket.

I confirmed this by umounting nfs mounts and the listen socket disappeared. Remounting caused a new listening socket to appear but on a different port.

If you are using your system as either an nfs client or server then that may be the source of the socket

Stack Exchange Network

current community

your communities

more stack exchange communities

What process is listening on a port?

3 Answers 3

Your Answer

Not the answer you're looking for? Browse other questions tagged process tcp netstat or ask your own question.

Linked

Hot Network Questions

What process is listening on a port?

3 Answers 3

Your Answer

Sign up or log in

Post as a guest

Not the answer you're looking for? Browse other questions tagged process tcp netstat or ask your own question.

Linked

Related

Hot Network Questions