No, it just means that your processes 13731, 24351 and 25072 have each made a connection to this host's port 443. A web server that could only server one connection at a time would not be a very good one, would it?
Also the process 25509 has made a connection to github.com's port 443.
The lsof
command displays esteblished network connections like this:
<local hostname/IP>:<local port> -> <remote hostname/IP>:<remote port>
So only the port specified in the <local port>
field actually belongs to the process listed on the line. Those are all random high-numbered ports: 35756, 49222 and 49648 respectively. This indicates these are very likely outgoing connections.
The part on the right side of the arrow just specifies where the "far end" of the connection is: it might be connected to a service on some other host, or to a port on the same host.
Note that the direction of the arrow has no relation to how the connection was established: in fact, your lsof
output should have also included lines associated with the HTTPS server process (could be httpd
, nginx
or some other server software), with possibly multiple PIDs indicating a multi-threaded/multi-process HTTPS server, and these in the NAME
field:
*:https (LISTEN)
(the *
might also be something different) - indicating that this process is listening for incoming connections
k8smasterone:https->k8smasterone:35756 (ESTABLISHED)
- the server-side end of the connection of process 13731
k8smasterone:https->k8smasterone:49222 (ESTABLISHED)
- the server-side end of the connection of process 24351
k8smasterone:https->k8smasterone:49648 (ESTABLISHED)
- the server-side end of the connection of process 25072
But if your configuration includes some DNAT, load balancing or cloud networking trickery, then the actual HTTPS server might well be in some other host, and so lsof
lines similar to these three would appear on that host instead.