0

Everytimes I open my pc and try

$ lsof -i :80

I get

COMMAND  PID       USER   FD   TYPE DEVICE SIZE/OFF NODE NAME firefox
3082 totoXXX   41u  IPv4 100396      0t0  TCP
totoXXX-PC-E15-Gen-2:39000->yyz12s07-in-f3.1e100.net:http
(ESTABLISHED) firefox 3082 totoXXX   93u  IPv4  45722      0t0  TCP
totoXXX-PC-E15-Gen-2:49470->82.221.107.34.bc.googleusercontent.com:http
(ESTABLISHED) firefox 3082 totoXXX  113u  IPv4  53661      0t0  TCP
totoXXX-PC-E15-Gen-2:49478->82.221.107.34.bc.googleusercontent.com:http
(ESTABLISHED) firefox 3082 totoXXX  125u  IPv4  58753      0t0  TCP
totoXXX-PC-E15-Gen-2:47658->server-3-161-216-55.yul62.r.cloudfront.net:http
(ESTABLISHED) firefox 3082 totoXXX  129u  IPv4  58755      0t0  TCP
totoXXX-PC-E15-Gen-2:43216->yyz12s07-in-f3.1e100.net:http
(ESTABLISHED) firefox 3082 totoXXX  187u  IPv4  57077      0t0  TCP
totoXXX-PC-E15-Gen-2:37900->192.229.211.108:http (ESTABLISHED) firefox
3082 totoXXX  188u  IPv4  57076      0t0  TCP
totoXXX-PC-E15-Gen-2:37892->192.229.211.108:http (ESTABLISHED) firefox
3082 totoXXX  190u  IPv4  57079      0t0  TCP
totoXXX-PC-E15-Gen-2:37926->192.229.211.108:http (ESTABLISHED) firefox
3082 totoXXX  192u  IPv4  57078      0t0  TCP
totoXXX-PC-E15-Gen-2:37910->192.229.211.108:http (ESTABLISHED) firefox
3082 totoXXX  194u  IPv4  57080      0t0  TCP
totoXXX-PC-E15-Gen-2:37938->192.229.211.108:http (ESTABLISHED) firefox
3082 totoXXX  202u  IPv4  66105      0t0  TCP
totoXXX-PC-E15-Gen-2:33126->a23-33-46-35.deploy.static.akamaitechnologies.com:http
(ESTABLISHED) firefox 3082 totoXXX  203u  IPv4  66106      0t0  TCP
totoXXX-PC-E15-Gen-2:33134->a23-33-46-35.deploy.static.akamaitechnologies.com:http
(ESTABLISHED) firefox 3082 totoXXX  204u  IPv4  66107      0t0  TCP
totoXXX-PC-E15-Gen-2:33146->a23-33-46-35.deploy.static.akamaitechnologies.com:http
(ESTABLISHED) firefox 3082 totoXXX  205u  IPv4  66108      0t0  TCP
totoXXX-PC-E15-Gen-2:33156->a23-33-46-35.deploy.static.akamaitechnologies.com:http
(ESTABLISHED) firefox 3082 totoXXX  206u  IPv4  66109      0t0  TCP
totoXXX-PC-E15-Gen-2:33170->a23-33-46-35.deploy.static.akamaitechnologies.com:http
(ESTABLISHED) firefox 3082 totoXXX  216u  IPv4  80777      0t0  TCP
totoXXX-PC-E15-Gen-2:57830->a-0003.a-msedge.net:http (ESTABLISHED)
firefox 3082 totoXXX  217u  IPv4  80778      0t0  TCP
totoXXX-PC-E15-Gen-2:57836->a-0003.a-msedge.net:http (ESTABLISHED)
firefox 3082 totoXXX  219u  IPv4  57119      0t0  TCP
totoXXX-PC-E15-Gen-2:37952->192.229.211.108:http (ESTABLISHED) firefox
3082 totoXXX  253u  IPv4  76362      0t0  TCP
totoXXX-PC-E15-Gen-2:43230->yyz12s07-in-f3.1e100.net:http
(ESTABLISHED) firefox 3082 totoXXX  288u  IPv4  76361      0t0  TCP
totoXXX-PC-E15-Gen-2:43222->yyz12s07-in-f3.1e100.net:http
(ESTABLISHED) firefox 3082 totoXXX  294u  IPv4  87975      0t0  TCP
totoXXX-PC-E15-Gen-2:38980->yyz12s07-in-f3.1e100.net:http
(ESTABLISHED) firefox 3082 totoXXX  315u  IPv4  96441      0t0  TCP
totoXXX-PC-E15-Gen-2:43212->server-3-161-216-55.yul62.r.cloudfront.net:http
(ESTABLISHED) firefox 3082 totoXXX  319u  IPv4  96442      0t0  TCP
totoXXX-PC-E15-Gen-2:43218->server-3-161-216-55.yul62.r.cloudfront.net:http
(ESTABLISHED) firefox 3082 totoXXX  364u  IPv4 100389      0t0  TCP
totoXXX-PC-E15-Gen-2:43228->server-3-161-216-55.yul62.r.cloudfront.net:http
(ESTABLISHED) firefox 3082 totoXXX  365u  IPv4 100390      0t0  TCP
totoXXX-PC-E15-Gen-2:43232->server-3-161-216-55.yul62.r.cloudfront.net:http
(ESTABLISHED) firefox 3082 totoXXX  374u  IPv4 109303      0t0  TCP
totoXXX-PC-E15-Gen-2:46512->cloudproxy10022.sucuri.net:http
(ESTABLISHED) firefox 3082 totoXXX  386u  IPv4  92828      0t0  TCP
totoXXX-PC-E15-Gen-2:44422->104.18.21.226:http (ESTABLISHED) firefox
3082 totoXXX  405u  IPv4 111699      0t0  TCP
totoXXX-PC-E15-Gen-2:54728->192.229.211.108:http (ESTABLISHED) firefox
3082 totoXXX  406u  IPv4 109305      0t0  TCP
totoXXX-PC-E15-Gen-2:53184->104.18.15.101:http (ESTABLISHED)

I am not a linux guru. I always do

sudo lsof -t -i tcp:80 -s tcp:listen | sudo xargs kill

to stop it before my local app stack nginx can run.

But why I am getting this? And how to stop getting this on all my linux starting?

3
  • 6
    Um, those port 80s are all on external hosts that your web browser is accessing. If you want to stop your browser from ever accessing the HTTP port on external hosts, either configure it to always use HTTPS (port 443), or simply stop browsing the web. Note that the local port (the source port) is fairly random. This is all normal behaviour.
    – Kusalananda ♦
    Aug 22 at 14:47
  • 3
    firefox is doing exactly what you've asked it to do, fetch and display some site over unencrypted HTTP. But it's not using port 80 on your machine, but the machine(s) in the other end of the connections firefox makes does listen on port 80, but that's a (conscious) choice by the administrator of those (as usage of SRV records - the only technology I remember having heard of that could change that - is far from widespread, the choice is basically between having their site online without SSL or not), and not your problem.
    – Henrik supports the community
    Aug 22 at 15:12
  • If you want to get rid of this, add the HTTPS everywhere extension to Firefox it will try to reduce the amount of HTTP connections
    – admstg
    Aug 22 at 15:26

2 Answers 2

Reset to default
3

In modern systems, if you run lsof as a regular user, the system may limit the information you can get so that you only get information about your own processes. When you run lsof -i :80, the command also lists processes on your user account that are either using local port 80 or connecting to remote port 80.

The first category might stop nginx from starting; your firefox belongs to the second category.

And because any web server running in port 80 is not running as your regular user account (because regular users won't be able to access local ports <1024), the plain lsof command without sudo will not be able to see the real culprit.

So your lsof listing that was generated without sudo not only lists firefox as a "false positive" regarding your actual issue, but also cannot identify the real showstopper because it has no root powers it would need to examine all the processes on the system.

But when you run

sudo lsof -t -i tcp:80 -s tcp:listen | sudo xargs kill

it will run both lsof and kill as root, so the command will find whatever is listening on local TCP port 80 and kill it.

To find out what is occupying your local port 80, run just the first part of the command without the -t switch:

sudo lsof -i tcp:80 -s tcp:listen
0
0

An IP connection is defined by 5 values:

  • protocol, in this case TCP
  • source IP, in your case the IP that belongs to totoXXX-PC-E15-Gen-2
  • source port, which are the numbers in the 30000 to 64000 in your output
  • destination address, for example the IP of 82.221.107.34.bc.googleusercontent.com
  • destination port, which is http in your output

This is what your lsof reports. The high port numbers are used by firefox on your system, port 80 (HTTP) is used by the webserver on the destination system.

The HTTP port 80 is where you make connection to. It is what the server listens to. You cannot change that, unless you control the server.

You are getting this, because you browse the web. This is normal Internet traffic from a browser.

To stop your Firefox connecting to port 80 on webservers requires drastic measures. iptables rules to block traffic, installing an add-on to Firefox, using a proxy all might work, but will cripple your web browsing experience.

It is also unclear why you should want to stop connecting to port 80 on those servers.

2
  • I need port 80 to run nginx for my application. I use docker for stack and on docker-compose up, nginx cannot start saying the port is used. Like I said, I use the command in my original post to "stop" and up my app stack again and then it is ok, I can start and work with my app. But this command doesn't prevent me to use firefox. Firefox continues to work after rhat and I can browse on internet. So I am very confused.
    – Cutis
    Aug 23 at 1:28
  • Port 80 in the lsof is the destination port on the destination system of the TCP/IP session. That is the webserver that you are browsing, not your system. On your system, you see totoXXX-PC-E15-Gen-2:33156. That means on your system, port 33156 is used for that session.
    – Ljm Dullaart
    Aug 23 at 8:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .