I have two linux servers. Let's say they are C and S.
C is client of S

On my S machine, I type.

$ netstat -an | grep ESTABLISHED
tcp 0 0 C:57010 ESTABLISHED

Then I can know C is connecting now.
In the C machine, I'd also like to know the process name which is opening the port 57010 and connecting the S server. How can I do that? Of course I have root permission of C.

3 Answers 3


One way is to say lsof -i:57010 -sTCP:ESTABLISHED. This walks the kernel's open file handle table looking for processes with an established TCP connection using that port. (Network sockets are file handles on *ix type systems.) You'd use -sTCP:LISTEN on the server side to filter out only the listener socket instead.

Because of the way lsof works, it can only see processes your user owns unless you run it as root. It's also fairly inefficient, since a typical *ix system has a lot of file handles open at any given time. The netstat method given in another answer is faster and usually has lower access requirements.

The lsof method has one great advantage, however: not all *ix type OSes have a netstat flag for including the process name in the output, whereas lsof has been ported to every *ix type OS you're likely to use. OS X's netstat is this way, for example. It has a -p option, but it does something different from netstat -p on Linux.

For an uncommon port number like the one in your question, you can typically get away without adding lsof's -s flag, because a given machine is unlikely to have programs both connecting to the port and listening on it. It can be helpful to add it with port numbers like HTTP's 80, where it is likely you'll have multiple programs using that port at once.

It's fortunate that the -s flag is optional in many situations, because that usage only works with lsof version 4.81 and newer. In older versions, -s meant something else entirely! That's a 2008 vintage change, but it can still bite unexpectedly. RHEL 5 ships with lsof 4.78, for example.


You can use netstat -anp | grep 57010 on server C. But this will only work if there isn't any firewall in between which is mapping port 57010 to a different one.

  • oh, thank you. easy. Is there a way to see the process's command line arguments?
    – Benjamin
    Jul 26, 2012 at 8:45
  • 3
    @Benjamin If you have process id nnn then ps waux | grep nnn will give you quite a bit of information. For more information yet, use cat /proc/nnn/cmdline though the spaces have been deleted (actually I think they are replaced by \0) so it is not easy to read.
    – Huygens
    Jul 26, 2012 at 9:00

Just for the sake of completeness:

Using ss from the new Linux networking utility tool-set (iproute2):

ss -tp sport = :57010 dst

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.