In the output of nmap -p- localhost I get an unknown open tcp port, that's different at each reboot. How can I determine which process opened it and listens through it. I tried many of the usual tools (netstat, ss, lsof) but I cannot find the culprit. Eg. sudo netstat -pan -Ainet | grep <PORT> gives no PID/Program name:

tcp 0 0<PORT>* LISTEN -

Maybe I should analyze the startup sequence? But how so?

Could anyone help?

  • Could it potentially be that you've got malware, which masks itself with - as name ? Consider trying pgrep "-". Also, try lsof stackoverflow.com/a/319997/3701431 – Sergiy Kolodyazhnyy May 30 '18 at 0:28
  • If any of the answers solved your problem, please accept it by clicking the checkmark next to it. Thank you! – Jeff Schaller Jun 3 '18 at 11:24
  • No answer solved my problem. And I don't have it anymore since I reinstalled the OS… – tofcute May 23 at 10:55

Netstat does exactly what you ask, when run as root and with the correct flags:

sudo netstat -tnlp
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0  *               LISTEN      1931/dnsmasq    
tcp        0      0 *               LISTEN      32296/cupsd     
tcp        0      0*               LISTEN      1550/postgres   
tcp6       0      0 :::80                   :::*                    LISTEN      3198/docker-proxy

Also, ss is the replacement of netstat and takes mostly the same flags, but has a differently formatted output

  • Did a similar command (netstat -pan -Ainet) that gets the same result: tcp 0 0* LISTEN - This does not give any process name nor PID as I get - instead. – tofcute May 29 '18 at 21:18
  • Without sudo it is not similar. You can only see the PID of processes started by your user/groups – Bruno9779 May 30 '18 at 13:30
  • Sorry, I forgot the sudo in my comment but I used it on my computer, as well as when using ss and lsof. – tofcute May 30 '18 at 17:43

As hinted at, ss can provide the answer as well; the syntax is:

sudo ss --tcp --listening --processes 'sport = 1234'

Where 1234 is the port-of-the-day from your nmap scan. This limits the output to TCP ports and shows the process name and PID that is listening on that port. sudo is only needed if you want the --process flag, which provides the process name and PID.

  • I din't know the 'sport = <PORT>' trick, I used a grep instead. Either way, here is what I get: LISTEN 0 64 *:41673 *:* No PID nor Program Name :-( – tofcute May 29 '18 at 21:28
  • Did you run it as root, or with sudo? – Jeff Schaller May 29 '18 at 21:53
  • I ran your command exactly as you gave it, from a user account, using sudo. Why? – tofcute May 30 '18 at 10:46
  • If you ran it without root privileges, you wouldn't be able to see the process name/pid; that could have explained the behavior. – Jeff Schaller May 30 '18 at 11:12

Some ports opened by the kernel and by some specific services (NFS, OCFS, ssh tunnels) are not visible with netstat nor ss

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.