When port-scanning my computer with another machine, I find three open ports:

Starting Nmap 7.40 ( https://nmap.org ) at 2017-05-08 22:14 CEST
Nmap scan report for laptop.local (
Host is up (0.00023s latency).
Not shown: 64998 closed ports
22/tcp    open  ssh
1716/tcp  open  xmsg
22000/tcp open  snapenetio

Nmap done: 1 IP address (1 host up) scanned in 14.62 seconds

netstat (from net-tools, version 1.60; run as root) on the machine itself however doesn't show 1716 and 22000:

# netstat -lnt 
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State         
tcp        0      0    *               LISTEN

I know that syncthing listens on 22000, and KDEConnect listens on 1716. But why doesn't netstat list these ports?

What would I need to do to find out which processes are attached to ports 22000 and 1716?

  • It may not be anything on the machine that has those ports open, but on an intermediate router. – Kusalananda May 8 '17 at 21:19
  • There's no router between the machine I was running nmap on and the host. They're in the same subnet. – Bob May 8 '17 at 21:21
  • Run nmap on the host itself, with – Kusalananda May 8 '17 at 21:21
  • It also shows 22000 and 1716 as open. – Bob May 8 '17 at 21:22
  • Look at /proc/net/tcp; the local_address column shows hex-encoded IP:port. – DopeGhoti May 9 '17 at 16:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.