why multi process take the same port in CentOS 7.9

Question

I am now using this command to see the port was using by which process:

lsof -i:443

but the output make me confusing:

[root@k8smasterone ~]# lsof -i:443
lsof: no pwd entry for UID 65532
lsof: no pwd entry for UID 1001
COMMAND     PID     USER   FD   TYPE   DEVICE SIZE/OFF NODE NAME
lsof: no pwd entry for UID 65532
traefik   13731    65532   10u  IPv4 10157368      0t0  TCP k8smasterone:35756->k8smasterone:https (ESTABLISHED)
lsof: no pwd entry for UID 1001
operator  24351     1001    6u  IPv4   515576      0t0  TCP k8smasterone:49222->k8smasterone:https (ESTABLISHED)
calico-ty 25072  polkitd    7u  IPv4   523993      0t0  TCP k8smasterone:49648->k8smasterone:https (ESTABLISHED)
wget      25509     root    4u  IPv4  9941865      0t0  TCP iZuf62lgwih3vksz3640gnZ:46538->cdn-185-199-110-154.github.com:https (ESTABLISHED)

is this tell me that 443 port was using by multi process? is it right? why could this happen?

Answer 1

No, it just means that your processes 13731, 24351 and 25072 have each made a connection to this host's port 443. A web server that could only server one connection at a time would not be a very good one, would it?

Also the process 25509 has made a connection to github.com's port 443.

The lsof command displays esteblished network connections like this:

<local hostname/IP>:<local port> -> <remote hostname/IP>:<remote port>

So only the port specified in the <local port> field actually belongs to the process listed on the line. Those are all random high-numbered ports: 35756, 49222 and 49648 respectively. This indicates these are very likely outgoing connections.

The part on the right side of the arrow just specifies where the "far end" of the connection is: it might be connected to a service on some other host, or to a port on the same host.

Note that the direction of the arrow has no relation to how the connection was established: in fact, your lsof output should have also included lines associated with the HTTPS server process (could be httpd, nginx or some other server software), with possibly multiple PIDs indicating a multi-threaded/multi-process HTTPS server, and these in the NAME field:

• *:https (LISTEN) (the * might also be something different) - indicating that this process is listening for incoming connections
• k8smasterone:https->k8smasterone:35756 (ESTABLISHED) - the server-side end of the connection of process 13731
• k8smasterone:https->k8smasterone:49222 (ESTABLISHED) - the server-side end of the connection of process 24351
• k8smasterone:https->k8smasterone:49648 (ESTABLISHED) - the server-side end of the connection of process 25072

But if your configuration includes some DNAT, load balancing or cloud networking trickery, then the actual HTTPS server might well be in some other host, and so lsof lines similar to these three would appear on that host instead.