How can I get CentOS to correctly list open ports?

Question

I am working with CentOS 7 OS hosting a set of docker containers.

By using a web browser I can reach a service on port 80 and I get back a response. A bit of local knowledge helps me understand that the response comes from one of the docker containers.

However, I have a big problem: I can't seem to find a way for the OS to indicate that port 80 is open. Here is what I have tried (all with root user):

• netstat -tulnp | grep 80 lists nothing listening on port 80
• ss -nutlp | grep 80 lists nothing listening on port 80
• lsof -i -P | grep 80 also lists nothing listening on port 80
• wget 127.0.0.1 successfully fetches index.html

Interrogating Docker directly through docker ps is not really the answer I am looking for, because we must be able to interrogate the OS and see what process is responsible for treating requests to port 80. It's also not helpful, because docker ps returns several containers that have the following entry in the PORTS column:

PORTS
80/tcp
8080/tcp
80/tcp

Again, I don't want to go to docker for answers, because there must be a way to interrogate the OS and identify the process responsible for handling port 80.

My only guess is that docker installs some sort of low-level driver that intercepts such network requests.

Any suggestions on how to get CentOS to hand out this information, accompanied with command line commands, would be greatly appreciated!

Answer 1

Are you certain the docker host is listening on port 80? It might be redirected from port 80 to whatever port it is listening on using the built-in firewall.

If you are running IPTABLES, you could check this by using:

iptables -L -t nat

You would then see a chain named DOCKER which will tell you what redirects are in place, similar to this:

Chain DOCKER (2 references)
target     prot opt source               destination         
RETURN     all  --  anywhere             anywhere            
RETURN     all  --  anywhere             anywhere            
DNAT       tcp  --  anywhere             anywhere             tcp dpt:http-alt to:172.17.0.3:80
DNAT       tcp  --  anywhere             anywhere             tcp dpt:4433 to:172.17.0.3:443
DNAT       tcp  --  anywhere             anywhere             tcp dpt:1688 to:172.17.0.4:1688