0

ifconfig lists several network interfaces, some of which are virtual ones.

How can I find out which processes are using or listening on which network interfaces? Thanks.

$ ifconfig
docker0: flags=4099<UP,BROADCAST,MULTICAST>  mtu 1500
        inet 172.17.0.1  netmask 255.255.0.0  broadcast 172.17.255.255
        ether 02:42:a6:79:a6:bc  txqueuelen 0  (Ethernet)
        RX packets 0  bytes 0 (0.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 0  bytes 0 (0.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

enp0s25: flags=4099<UP,BROADCAST,MULTICAST>  mtu 1500
        ether   txqueuelen 1000  (Ethernet)
        RX packets 0  bytes 0 (0.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 0  bytes 0 (0.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0
        device interrupt 20  memory 0xfc400000-fc420000  

lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
        inet 127.0.0.1  netmask 255.0.0.0
        inet6 ::1  prefixlen 128  scopeid 0x10<host>
        loop  txqueuelen 1000  (Local Loopback)
        RX packets 3102389  bytes 174723039 (174.7 MB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 3102389  bytes 174723039 (174.7 MB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

virbr0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 192.168.122.1  netmask 255.255.255.0  broadcast 192.168.122.255
        ether 52:54:00:b1:aa:1f  txqueuelen 1000  (Ethernet)
        RX packets 708  bytes 68468 (68.4 KB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 316  bytes 51806 (51.8 KB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

vnet0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet6 fe80::fc54:ff:fe99:5eee  prefixlen 64  scopeid 0x20<link>
        ether fe:54:00:99:5e:ee  txqueuelen 1000  (Ethernet)
        RX packets 257  bytes 28494 (28.4 KB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 23514  bytes 1240204 (1.2 MB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

wlx8: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 192.168.1.97  netmask 255.255.255.0  broadcast 192.168.1.255
        inet6   prefixlen 64  scopeid 0x20<link>
        ether 80:1f:02:b5:c3:89  txqueuelen 1000  (Ethernet)
        RX packets 1269625  bytes 1045069752 (1.0 GB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 646600  bytes 101897054 (101.8 MB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0
  • Network Interface? They're listening on addresses, or say holding an opened socket, if on POSIX system. – 炸鱼薯条德里克 Mar 25 at 16:36
1

ss -plnt will list processes listening numerically on tcp ports and will show you the IP and port bound to, as well as relevant PIDs and file descriptors:

$ sudo ss -plnt | grep -E ':(22|8384)[^0-9]'
LISTEN   0         128            192.168.42.2:8384             0.0.0.0:*        users:(("syncthing",pid=14565,fd=8))
LISTEN   0         128                 0.0.0.0:22               0.0.0.0:*        users:(("sshd",pid=6099,fd=3))
LISTEN   0         128                    [::]:22                  [::]:*        users:(("sshd",pid=6099,fd=4))

Compare the same from the older netstat -plnt:

$ sudo netstat -plnt | grep -E ':(22|8384)[^0-9]'
tcp        0      0 192.168.42.2:8384       0.0.0.0:*               LISTEN      14565/syncthing
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      6099/sshd
tcp6       0      0 :::22                   :::*                    LISTEN      6099/sshd

Shown are the secure shell daemon (listening on all interfaces), and my local install of SyncThing (which has its management interface is bound explicitly to one network address).

  • Strange ss -plnt did not show ssh for me, but netstat does. – Luciano Andress Martini Mar 25 at 15:54
  • Try looking for the numerical port: ss -plnt | grep ':22'. – DopeGhoti Mar 25 at 16:20
  • netstat looks better! Is it being deprecated? ( I always used it, never heared about ss replacing it, I thinked it is just an alternative, seems that every alternative in Linux are replacing the old ones ) – Luciano Andress Martini Mar 25 at 17:31
  • I prefer netstat as well, though admittedly largely due to familiarity from long usage. As to the why of it? That is beyond my pay-grade. – DopeGhoti Mar 25 at 18:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.