6

Using Ubuntu Server 16. Something on my machine has an SCTP port open, and I need to find it and kill it (without rebooting).

lsof doesn't show SCTP sockets, only TCP and UDP.

I'm looking through all these network utilities, and SCTP support is surprisingly scarce for such an old standard. I got netstat to work with SCTP by building the bleeding edge net-tools from here. sudo netstat --sctp -tulpn shows some open SCTP connections but doesn't say which process has them. It only shows the PIDs for UDP and TCP sockets.

6

Sort of a hacky roundabout way but it seems to work for me. Hoping someone will find a better way, but my first thoughts (ss/netstat) don't seem to acknowledge SCTP.

First, use procfs to find the inode of the sctp connection:

$ cat /proc/net/sctp/eps
 ENDPT     SOCK   STY SST HBKT LPORT   UID INODE LADDRS
b6d72780 a8903800 2   10  48   123       0 1895802 0.0.0.0

Take that inode (1895802 in my example) and use lsof to find who owns it:

$ lsof -R | grep 1895802
socat      8697        2045             root    5u     sock    1895802      0t0       SCTP ENDPT: b6d72780 0.0.0.0[123]

As you can see, I was using socat to make a socket listening on 123/sctp. 8697 is the pid.

  • 2
    Oh, interesting. The new netstat I installed does actually show the PID of my ncat SCTP listener but not the mystery process (or whatever it is). And procfs doesn't show anything either. So maybe I somehow have sockets open with no process using them. But that is a separate issue, and this answers my question. – sudo May 25 '17 at 3:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.