4

In the Cent OS 7, I use the netstat -an to check the network service:

[root@localhost etc]# netstat -an | grep ESTABLISHED
udp        0      0 192.168.1.25:41136      61.216.153.106:123      ESTABLISHED
udp        0      0 192.168.1.25:59141      202.112.29.82:123       ESTABLISHED
udp        0      0 192.168.1.25:53680      115.28.122.198:123      ESTABLISHED
udp        0      0 192.168.1.25:34255      42.51.22.35:123         ESTABLISHED

You can see up there the ephemeral 41136 port. If a service uses port 3306 we can know it is MySQL, if port is 8080 we can know it is Tomcat, but how about the ephemeral ports? how can we know which service is associated with these ports?

11

As for ephemeral ports:

The Internet Assigned Numbers Authority (IANA) suggests the range 49152 to 65535 (215+214 to 216−1) for dynamic or private ports. Many Linux kernels use the port range 32768 to 61000

Looking at the destination on the TCP/IP tuple as in the example you ask:

udp        0      0 192.168.1.25:41136      61.216.153.106:123

You can see it is the current machine using an NTP service UDP/123 on a remote server.

Or else, it is your machine doing an NTP request to an NTP server in China.

Actually, all those 4 lines are connections to NTP servers in China.

Usually, with the majority of protocols, when the known port service is on your side (first), you usually are the server receiving the connection, and the ephemeral port is on the right side; when it is the contrary, often it is your server that is using a remote service.

(Is your server in China? If not I would worry about possible malware)

You can also take the out -n, for resolving IP addresses/DNS and service names, however be aware that it introduces a noticeable lag in a machine/server with many connections (and/or with a slow DNS service). To have a feel of the difference try, I adapted your original netstat output for a possible output without -n:

$netstat -a | grep ESTABLISHED
udp        0      0 mylinux:41136      vns1.hinet.net:ntp        ESTABLISHED
udp        0      0 mylinux:59141      DNS1.SYNET.EDU.CN:ntp     ESTABLISHED
udp        0      0 mylinux:53680      rdns1.alidns.com:ntp      ESTABLISHED
udp        0      0 mylinux:34255      ns1.htudns.com:ntp        ESTABLISHED
  • That this is NTP is a plausible guess, but you know for sure only when snooping the actual traffic. It could be as well some malware talking to a command center using innocent looking ports. – countermode Jun 27 '17 at 11:42
  • @countermode Granted, however the DNS names seem to be legit NTP servers. – Rui F Ribeiro Jun 27 '17 at 11:59
  • "Are you in China?" OP's profile says United States. – a CVn Jun 27 '17 at 12:53
  • @MichaelKjörling I had for a long time London in my profile...Given the post and the command of English of the OP...That would be a long talk about not questioning location (and sex) in profiles. DNS names seem all also legit, hinet and alicloud. Actually, even could be someone in USA using alibaba cloud services – Rui F Ribeiro Jun 27 '17 at 12:57
  • @MichaelKjörling Corrected the answer, we are only concerned where the server is located. – Rui F Ribeiro Jun 27 '17 at 13:10
10

You can use netstat -p to get the pid and name of the program that has opened the port on the local side; this can be combined with -a and -n as usual.

On most systems, you need root privileges to do that.

  • 1
    This is particularly useful if something is LISTENING on an unknown port and you want to find out which process is involved. – TripeHound Jun 27 '17 at 6:57
  • 2
    Root privileges are only required to get the "full picture": a user running netstat -p is still able to see the PID and process name for any processes they do own (processes who are running using the user's UID). – knoepfchendruecker Jun 27 '17 at 8:32
  • @TripeHound It also works for ESTABLISHED outbound connections (such as the OP is seeing). E.g.: tcp 0 0 192.168.97.150:60625 192.168.97.15:80 ESTABLISHED 21633/chromium – marcelm Jun 27 '17 at 13:27
4

As you can see in the netstat (network statistics) output,

Proto Recv-Q Send-Q Local Address           Foreign Address         State   
udp        0      0 192.168.1.25:41136      61.216.153.106:123      ESTABLISHED

192.168.1.25 is your local/source IP Address in LAN.

41136 is the source port number.

61.216.153.106 is destination IP Address.

123 is the destination port number which represents Network Time Protocol (NTP)

The source port number (41136) serves analogues to the destination port (123 or NTP), but is used by the sending host (192.168.1.25) to help keep track of new incoming connections and existing data streams.

Generally, clients/source address (192.168.1.25) set the source port number to a unique number that they choose themselves - usually based on the program that started the connection.

In this case, the source port number chosen by your computer is 41136.

This number is random and normally bigger than 1024.

Look at another example. In this case, all destination ports is UDP 123 which is NTP while the source port number is different and random.

Proto Recv-Q Send-Q Local Address           Foreign Address         State   
udp        0      0 192.168.1.25:59141      202.112.29.82:123       ESTABLISHED
udp        0      0 192.168.1.25:53680      115.28.122.198:123      ESTABLISHED
udp        0      0 192.168.1.25:34255      42.51.22.35:123         ESTABLISHED
  • 2
    Whilst networking theory does indeed define ephemeral ports > 1024, BSD kernels are usually by default configured to use them in the 49152 to 65535 range, and Linux kernels in the 32768 to 61000 range. Beware you have other services in ports > 1024, like X or NFS. (I actually wrote the same in one of my edits, but edited it out almost as soon as I saved it). – Rui F Ribeiro Jun 26 '17 at 15:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.