Communiversity

Linux: Find Out Which Process Is Listening Upon a Portby Vivek Gite (http://www.cyberciti.biz/tips/about-us) on October 31, 2010 · 13 comments (http://www.cyberciti.biz/faq/what-process-has-open-linux-port/#comments)

(https://www.abibitumikasa.com/proxy.php?request=http%3A%2F%2Ffiles.cyberciti.biz%2Fcbzcache%2F3rdparty%2Flinux-logo.png&hash=515995c9c65652e5de70503a1752938de74bfa91) (http://www.cyberciti.biz/faq/category/linux/)
How  do I find out running processes were associated with each open port?  How do I find out what process has open tcp port 111 or udp port 7000  under Linux?
 
 You can the following programs to find out about port numbers and its associated process:

'"

n".self::process_list_items("'.str_replace('
', '', '

• netstat - a command-line tool that displays network connections, routing tables, and a number of network interface statistics.
  
• fuser - a command line tool to identify processes using files or sockets.
  
• lsof  - a command line tool to list open files under Linux / UNIX  to report a  list of all open files and the processes that opened them.
  
• /proc/$pid/  file system - Under Linux /proc includes a directory for each running  process (including kernel processes) at /proc/PID, containing  information about that process, notably including the processes name  that opened port.
  ').'")."n[/list type=decimal]"'
  You must run above command as root.
  netstat exampleType the following command:
   '
  Code Select Expand
  '.str_replace('
', '', '[code]# netstat -tulpn').'[/code]'
   Sample outputs:
  
  '
  Code Select Expand
  '.str_replace('
', '', '
Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name tcp        0      0 127.0.0.1:3306          0.0.0.0:*               LISTEN      1138/mysqld tcp        0      0 0.0.0.0:111             0.0.0.0:*               LISTEN      850/portmap tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN      1607/apache2 tcp        0      0 0.0.0.0:55091           0.0.0.0:*               LISTEN      910/rpc.statd tcp        0      0 192.168.122.1:53        0.0.0.0:*               LISTEN      1467/dnsmasq tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      992/sshd tcp        0      0 127.0.0.1:631           0.0.0.0:*               LISTEN      1565/cupsd tcp        0      0 0.0.0.0:7000            0.0.0.0:*               LISTEN      3813/transmission tcp6       0      0 :::22                   :::*                    LISTEN      992/sshd tcp6       0      0 ::1:631                 :::*                    LISTEN      1565/cupsd tcp6       0      0 :::7000                 :::*                    LISTEN      3813/transmission udp        0      0 0.0.0.0:111             0.0.0.0:*                           850/portmap udp        0      0 0.0.0.0:662             0.0.0.0:*                           910/rpc.statd udp        0      0 192.168.122.1:53        0.0.0.0:*                           1467/dnsmasq udp        0      0 0.0.0.0:67              0.0.0.0:*                           1467/dnsmasq udp        0      0 0.0.0.0:68              0.0.0.0:*                           3697/dhclient udp        0      0 0.0.0.0:7000            0.0.0.0:*                           3813/transmission udp        0      0 0.0.0.0:54746           0.0.0.0:*                           910/rpc.statd   ').'[/code]'TCP port 3306 was opened by mysqld process having PID # 1138. You can verify this using /proc, enter:
   '
  Code Select Expand
  '.str_replace('
', '', '[code]# ls -l /proc/1138/exe ').'[/code]'
   Sample outputs:
  
  '
  Code Select Expand
  '.str_replace('
', '', '
lrwxrwxrwx 1 root root 0 2010-10-29 10:20 /proc/1138/exe -> /usr/sbin/mysqld').'[/code]'You can use grep command (http://www.cyberciti.biz/faq/howto-use-grep-command-in-linux-unix/) to filter out information:
   '
  Code Select Expand
  '.str_replace('
', '', '[code]# netstat -tulpn | grep :80').'[/code]'
   Sample outputs:
  
  '
  Code Select Expand
  '.str_replace('
', '', '
tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN      1607/apache2').'[/code]'fuser commandFind out the processes PID that opened tcp port 7000, enter:
   '
  Code Select Expand
  '.str_replace('
', '', '[code]# fuser 7000/tcp').'[/code]'
   Sample outputs:
  
  '
  Code Select Expand
  '.str_replace('
', '', '
7000/tcp:             3813').'[/code]'Finally, find out process name associated with PID # 3813, enter:
   '
  Code Select Expand
  '.str_replace('
', '', '[code]# ls -l /proc/3813/exe ').'[/code]'
   Sample outputs:
  
  '
  Code Select Expand
  '.str_replace('
', '', '
lrwxrwxrwx 1 vivek vivek 0 2010-10-29 11:00 /proc/3813/exe -> /usr/bin/transmission').'[/code]'/usr/bin/transmission is a bittorrent client, enter:
   '
  Code Select Expand
  '.str_replace('
', '', '[code]# man transmission').'[/code]'
   OR
   '
  Code Select Expand
  '.str_replace('
', '', '[code]# whatis transmission').'[/code]'
   Sample outputs:
  
  '
  Code Select Expand
  '.str_replace('
', '', '
transmission (1)     - a bittorrent client').'[/code]'Task: Find Out Current Working Directory Of a ProcessTo find out current working directory of a process called bittorrent or pid 3813, enter:
   '
  Code Select Expand
  '.str_replace('
', '', '[code]# ls -l /proc/3813/cwd').'[/code]'
   Sample outputs:
  
  '
  Code Select Expand
  '.str_replace('
', '', '
lrwxrwxrwx 1 vivek vivek 0 2010-10-29 12:04 /proc/3813/cwd -> /home/vivek').'[/code]'OR use pwdx command, enter:
   '
  Code Select Expand
  '.str_replace('
', '', '[code]#  pwdx 3813').'[/code]'
   Sample outputs:
  
  '
  Code Select Expand
  '.str_replace('
', '', '
3813: /home/vivek').'[/code]'Task: Find Out Owner Of a ProcessUse the following command to find out the owner of a process PID called 3813:
   '
  Code Select Expand
  '.str_replace('
', '', '[code]# ps aux | grep 3813').'[/code]'
   OR
   '
  Code Select Expand
  '.str_replace('
', '', '[code]# [url=http://www.cyberciti.biz/tips/grepping-ps-output-without-getting-grep.html]ps aux | grep '[3]813'[/url]').'[/code]'
   Sample outputs:
  
  '
  Code Select Expand
  '.str_replace('
', '', '
vivek     3813  1.9  0.3 188372 26628 ?        Sl   10:58   2:27 transmission').'[/code]'OR try the following ps command:
   '
  Code Select Expand
  '.str_replace('
', '', '[code]# ps -eo pid,user,group,args,etime,lstart | grep '[3]813'').'[/code]'
   Sample outputs:
  
  '
  Code Select Expand
  '.str_replace('
', '', '
3813 vivek    vivek    transmission                   02:44:05 Fri Oct 29 10:58:40 2010').'[/code]'Another option is /proc/$PID/environ, enter:
   '
  Code Select Expand
  '.str_replace('
', '', '[code]# cat /proc/3813/environ').'[/code]'
   OR
   '
  Code Select Expand
  '.str_replace('
', '', '[code]# grep --color -w -a USER /proc/3813/environ').'[/code]'
   Sample outputs (note --colour option):
  
   (https://www.abibitumikasa.com/proxy.php?request=http%3A%2F%2Ffiles.cyberciti.biz%2Fuploads%2Ffaq%2F2010%2F10%2Fpid-owner.png&hash=1e9b367584afd8bbc387988167cf7e3157bd81e2) (http://www.cyberciti.biz/faq/what-process-has-open-linux-port/pid-owner/)Fig.01: grep output
  
  lsof Command ExampleType the command as follows:
  '
  Code Select Expand
  '.str_replace('
', '', '
lsof -i :portNumber lsof -i tcp:portNumber lsof -i udp:portNumber lsof -i :80 lsof -i :80 | [b]grep[/b] LISTEN').'[/code]'Sample outputs:
  '
  Code Select Expand
  '.str_replace('
', '', '
apache2   1607     root    3u  IPv4   6472      0t0  TCP *:www (LISTEN) apache2   1616 www-data    3u  IPv4   6472      0t0  TCP *:www (LISTEN) apache2   1617 www-data    3u  IPv4   6472      0t0  TCP *:www (LISTEN) apache2   1618 www-data    3u  IPv4   6472      0t0  TCP *:www (LISTEN) apache2   1619 www-data    3u  IPv4   6472      0t0  TCP *:www (LISTEN) apache2   1620 www-data    3u  IPv4   6472      0t0  TCP *:www (LISTEN)').'[/code]'Now, you get more information about pid # 1607 or 1616 and so on:
   '
  Code Select Expand
  '.str_replace('
', '', '[code]# ps aux | grep '[1]616'').'[/code]'
   Sample outputs:
   '
  Code Select Expand
  '.str_replace('
', '', '[code]www-data  1616  0.0  0.0  35816  3880 ?        S    10:20   0:00 /usr/sbin/apache2 -k start').'[/code]'
   I recommend the following command to grab info about pid # 1616:
   '
  Code Select Expand
  '.str_replace('
', '', '[code]# ps -eo pid,user,group,args,etime,lstart | grep '[1]616'').'[/code]'
   Sample outputs:
  
  '
  Code Select Expand
  '.str_replace('
', '', '
1616 www-data www-data /usr/sbin/apache2 -k start     03:16:22 Fri Oct 29 10:20:17 2010').'[/code]'Where,
  '
  Code Select Expand
  '.str_replace('
', '', '
'"[list]n".self::process_list_items("'.str_replace('
', '', '
[*][b]1616[/b] : PID
[*][b]www-date[/b] : User name (owner - EUID)
[*][b]www-date[/b] : Group name (group - EGID)
[*][b]/usr/sbin/apache2 -k start[/b] : The command name and its args
[*][b]03:16:22[/b] : Elapsed time since the process was started, in the form [[dd-]hh:]mm:ss.
[*][b]Fri Oct 29 10:20:17 2010[/b] : Time the command started.
').'")."n[/list]"'
').''Help: I Discover an Open Port Which I Don't Recognize At AllThe file /etc/services is used to map port numbers and protocols to service names. Try matching port numbers:
   '
  Code Select Expand
  '.str_replace('
', '', '[code]$ grep port /etc/services
 $ grep 443 /etc/services').'[/code]'
   Sample outputs:
  
  '
  Code Select Expand
  '.str_replace('
', '', '
https 443/tcp # http protocol over TLS/SSL https 443/udp').'[/code]'Check For rootkitI strongly recommend  that you find out which processes are really running, especially servers  connected to the high speed Internet access. You can look for rootkit  which is a program designed to take fundamental control (in Linux / UNIX  terms "root" access, in Windows terms "Administrator" access) of a  computer system, without authorization by the system's owners and  legitimate managers. See how to detecting / checking rootkits under Linux (http://www.cyberciti.biz/faq/howto-check-linux-rootkist-with-detectors-software/).
  Keep an Eye On Your Bandwidth GraphsUsually, rooted servers are used to send a large number of spam or  malware or DoS style attacks on other computers.
  See also:See the following man pages for more information:
   '
  Code Select Expand
  '.str_replace('
', '', '[code]$ man ps
 $ man grep
 $ man lsof
 $ man netstat
 $ man fuser').'[/code]'