I am working with CentOS 7 OS hosting a set of docker containers.

By using a web browser I can reach a service on port 80 and I get back a response. A bit of local knowledge helps me understand that the response comes from one of the docker containers.

However, I have a big problem: I can't seem to find a way for the OS to indicate that port 80 is open. Here is what I have tried (all with root user):

  • netstat -tulnp | grep 80 lists nothing listening on port 80
  • ss -nutlp | grep 80 lists nothing listening on port 80
  • lsof -i -P | grep 80 also lists nothing listening on port 80
  • wget successfully fetches index.html

Interrogating Docker directly through docker ps is not really the answer I am looking for, because we must be able to interrogate the OS and see what process is responsible for treating requests to port 80. It's also not helpful, because docker ps returns several containers that have the following entry in the PORTS column:


Again, I don't want to go to docker for answers, because there must be a way to interrogate the OS and identify the process responsible for handling port 80.

My only guess is that docker installs some sort of low-level driver that intercepts such network requests.

Any suggestions on how to get CentOS to hand out this information, accompanied with command line commands, would be greatly appreciated!

1 Answer 1


Are you certain the docker host is listening on port 80? It might be redirected from port 80 to whatever port it is listening on using the built-in firewall.

If you are running IPTABLES, you could check this by using:

iptables -L -t nat

You would then see a chain named DOCKER which will tell you what redirects are in place, similar to this:

Chain DOCKER (2 references)
target     prot opt source               destination         
RETURN     all  --  anywhere             anywhere            
RETURN     all  --  anywhere             anywhere            
DNAT       tcp  --  anywhere             anywhere             tcp dpt:http-alt to:
DNAT       tcp  --  anywhere             anywhere             tcp dpt:4433 to:
DNAT       tcp  --  anywhere             anywhere             tcp dpt:1688 to:
  • 1
    Thank you, it certainly was iptables! I've made a mistake of using -S without specifying the exact table, leaving me with an impression that there were no nat rules
    – Tony Sepia
    Apr 15, 2021 at 14:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.