Linux open ports by process

How to find ports opened by process ID in Linux?

Hmm..I don’t seem to have the —all and —program options. I’m using OSX. Brew doesn’t seem to have a formula for it either.

-n will dramatically speed things up by not resolving hostnames. netsta -tupan is a good default command all and easy to remember.

You can use the command below:

As a side note, netstat -ao will read the /proc/PID/tcp etc to see the ports opened by the process. This means that its reading information supplied by the system (the linux KERNEL), and is in no way directly looking on the network interface or other means. Same goes for lsof.

If you are doing this as a security measure, you failed. You should never (NEVER EVER) trust the output of netstat, even if you are 100% sure you are in fact running a real netstat program (as opposed to a trojaned version) or any other program that reads the /proc filesystem. Some people seem to think that netstat, ls, ps or any other of the standard unix tools do some sort of magic and poll information from the sources, the truth is all of them rely on the /proc filesystem to get all of their data, which can be easily subverted by a rootkit or hypervisor.

If you’re dealing with a rootkitted system or a compromised hypervisor, you can’t trust anything, including something that purports to look directly at the network interface.

You can use the netstat command line tool with the -p command line argument:

-p (Linux):

Process: Show which processes are using which sockets (similar to -b under Windows). You must be root to do this.

To display all ports open by a process with id $PID :

In some embedded devices or with old version of Linux, the problem is netstat do not have —process or -p options available.

The following script shows process with its IP and port, you must be root.

#!/bin/bash for protocol in tcp udp ; do #echo "protocol $protocol" ; for ipportinode in `cat /proc/net/$ | awk '/.*:.*:.*/'` ; do #echo "#ipportinode=$ipportinode" inode=`echo "$ipportinode" | cut -d"|" -f3` ; if [ "#$inode" = "#" ] ; then continue ; fi lspid=`ls -l /proc/*/fd/* 2>/dev/null | grep "socket:\[$inode\]" 2>/dev/null` ; pid=`echo "lspid=$lspid" | awk 'BEGIN /socket/'` ; if [ "#$pid" = "#" ] ; then continue ; fi exefile=`ls -l /proc/$pid/exe | awk 'BEGIN ">/->/'` #echo "$protocol|$pid|$ipportinode" echo "$protocol|$pid|$ipportinode|$exefile" | awk ' BEGIN function iphex2dec(ipport) < ret=sprintf("%d.%d.%d.%d: %d","0x"substr(ipport,1,2),"0x"substr(ipport,3,2), "0x"substr(ipport,5,2),"0x"substr(ipport,7,2),"0x"substr(ipport,10,4)) ; if( ret == "0.0.0.0:0" ) #compatibility others awk versions < ret= strtonum("0x"substr(ipport,1,2)) ; ret=ret "." strtonum("0x"substr(ipport,3,2)) ; ret=ret "." strtonum("0x"substr(ipport,5,2)) ; ret=ret "." strtonum("0x"substr(ipport,7,2)) ; ret=ret ":" strtonum("0x"substr(ipport,10)) ; >return ret ; > < print $1" pid:"$2" local="iphex2dec($3)" remote="iphex2dec($4)" inode:"$5" exe=" $6 ; >' ; #ls -l /proc/$pid/exe ; done ; done 

tcp pid:1454 local=1.0.0.127:5939 remote=0.0.0.0:0 inode:13955 exe=/opt/teamviewer/tv_bin/teamviewerd tcp pid:1468 local=1.1.0.127:53 remote=0.0.0.0:0 inode:12757 exe=/usr/sbin/dnsmasq tcp pid:1292 local=0.0.0.0:22 remote=0.0.0.0:0 inode:12599 exe=/usr/sbin/sshd tcp pid:4361 local=1.0.0.127:631 remote=0.0.0.0:0 inode:30576 exe=/usr/sbin/cupsd tcp pid:1375 local=1.0.0.127:5432 remote=0.0.0.0:0 inode:12650 exe=/usr/lib/postgresql/9.3/bin/postgres 

With ls you can know the process route.

The fuser command says that the process is: 2054

I’ve added IPv6 support and made a few fixes. Additionally on my system the octets of the IP address are reversed. Dependencies are only to posix shell, awk and cut.

My Version can be found on Github

#!/bin/sh # prints all open ports from /proc/net/* # # for pretty output (if available) start with # ./linux-get-programm-to-port.sh | column -t -s $'\t' #set -x ip4hex2dec () < local ip4_1octet="0x$" local ip4_2octet="$" ip4_2octet="0x$" local ip4_3octet="$" ip4_3octet="0x$" local ip4_4octet="$" ip4_4octet="0x$" local ip4_port="0x$" # if not used inverse #printf "%d.%d.%d.%d:%d" "$ip4_1octet" "$ip4_2octet" "$ip4_3octet" "$ip4_4octet" "$ip4_port" printf "%d.%d.%d.%d:%d" "$ip4_4octet" "$ip4_3octet" "$ip4_2octet" "$ip4_1octet" "$ip4_port" > # reoder bytes, byte4 is byte1 byte2 is byte3 . reorderByte() < if [ $-ne 8 ]; then echo "missuse of function reorderByte"; exit; fi local byte1="$" local byte2="$" byte2="$" local byte3="$" byte3="$" local byte4="$" echo "$byte4$byte3:$byte2$byte1" > # on normal intel platform the byte order of the ipv6 address in /proc/net/*6 has to be reordered. ip6hex2dec()< local ip_str="$" local ip6_port="0x$" local ipv6="$(reorderByte $)" local shiftmask="$" ipv6="$ipv6:$(reorderByte $)" shiftmask="$" ipv6="$ipv6:$(reorderByte $)" ipv6="$ipv6:$(reorderByte $)" ipv6=$(echo $ipv6 | awk '< gsub(/(:0|^0)/, ":"); sub(/(:0)+:/, "::");print>') printf "%s:%d" "$ipv6" "$ip6_port" > for protocol in tcp tcp6 udp udp6 raw raw6; do #echo "protocol $protocol" ; for ipportinode in `cat /proc/net/$protocol | awk '/.*:.*:.*/'` ; do #echo "#ipportinode=$ipportinode" inode=$ if [ "#$inode" = "#" ] ; then continue ; fi lspid=`ls -l /proc/*/fd/* 2>/dev/null | grep "socket:\[$inode\]" 2>/dev/null` ; pids=`echo "$lspid" | awk 'BEGIN /socket/ END>'` ; # removes duplicats for this pid #echo "#lspid:$lspid #pids:$pids" for pid in $pids; do if [ "#$pid" = "#" ] ; then continue ; fi exefile=`ls -l /proc/$pid/exe | awk 'BEGIN ">/->/'`; cmdline=`cat /proc/$pid/cmdline` local_adr_hex=$ remote_adr_hex=$ remote_adr_hex=$ if [ "#$" = "#6" ]; then local_adr=$(ip6hex2dec $local_adr_hex) remote_adr=$(ip6hex2dec $remote_adr_hex) else local_adr=$(ip4hex2dec $local_adr_hex) remote_adr=$(ip4hex2dec $remote_adr_hex) fi echo "$protocol pid:$pid \t$local_adr \t$remote_adr \tinode:$inode \t$exefile $cmdline" done done done 

Источник

How to find ports opened by process ID in Linux?

We can use the lsof command to list the open ports on the system using the following command: In the above command: Option -i: selects the listing of files, any of whose Internet address matches the address specified in i. Option -P: inhibits the conversion of port numbers to port names for network files. But before that to get the list of all port on the system, you can use the following command: Now let’s see how to find out the list of open ports in the Linux systems.

Ways to Find Out List of All Open Ports in Linux

In this article, we are going to see how to find out the list of all open ports in linux. Ports are the endpoint of communication in the computer networks, or we can also say that the port is working as the door for communication on the computer network. The ports are basically 16-bit numbers (from 0 to 65535). These ports are used to communicate by the Internet transport protocols like the Transmission Control Protocol (TCP) and the User Datagram Protocol (UDP).

The ports are categorized by the range of port number as follows:

1. From 0 to 1023: These ports are known as the Well-known ports. These ports can only be used by system (or root) processes or by programs executed by privileged users.
2. From 1024 to 49151:These ports are known as the Registered ports. These ports can be used by ordinary user processes or programs executed by ordinary users.
3. From 49152 to 65535:These ports are known as Dynamic Ports.

We are going to see what are the by which we can find out the list of open ports in the Linux systems. But before that to get the list of all port on the system, you can use the following command:

Now let’s see how to find out the list of open ports in the Linux systems.

There are three ways by which we can find the list of open ports on the Linux system. Let’s see them one by one.

Method 1: Using netstat tool

The Netstat is a tool which give the information about the Linux networking subsystem. We use the netstat to list all open ports on the system. Use the following command to list all open ports on the system.

In the above command:

• Option -l: list only listening sockets.
• Option -n: show the port number.
• Option -t: list the TCP ports.
• Option -u: list the UDP ports

Method 2: Using ss tool

ss is another tool to investigate sockets. Which is the best alternative to the netstat command. So we can also use the ss tool to list the open ports on the system. Use the following command to list the all ports on the system.

The meaning of all options used with the above command are the same as the previous netstat command.

Method 3: lsof command

lsof is the command which is used to list the files. We can use the lsof command to list the open ports on the system using the following command:

$ sudo lsof -i -P -n | grep LISTEN

In the above command:

• Option -i: selects the listing of files, any of whose Internet address matches the address specified in i.
• Option -P: inhibits the conversion of port numbers to port names for network files.
• Option -n: inhibits the conversion of network numbers to host names for network files

So we have learned how to leas the all open ports in the Linux system. To know more above the above command, read the man page of the above commands.

Ways to Find Out List of All Open Ports in Linux, There are three ways by which we can find the list of open ports on the Linux system. Let’s see them one by one. Method 1: Using netstat tool. The netstat is a tool which give the information about the Linux networking subsystem. We use the netstat to list all open ports on the system. Use the following command to list all open ports on the

How to find ports opened by process ID in Linux?

Suppose the PID of the process is already known

netstat --all --program | grep '3265' 

• —all show listening and non-listening sockets.
• —program show the PID and name of the program to which socket belongs.

You could also use a port scanner such as Nmap.

You can use the command below:

As a side note, netstat -ao will read the /proc/ PID /tcp etc to see the ports opened by the process. This means that its reading information supplied by the system (the linux KERNEL), and is in no way directly looking on the network interface or other means. Same goes for lsof.

If you are doing this as a security measure, you failed. You should never (NEVER EVER) trust the output of netstat, even if you are 100% sure you are in fact running a real netstat program (as opposed to a trojaned version) or any other program that reads the /proc filesystem. Some people seem to think that netstat, ls, ps or any other of the standard unix tools do some sort of magic and poll information from the sources, the truth is all of them rely on the /proc filesystem to get all of their data, which can be easily subverted by a rootkit or hypervisor.

You can use the netstat command line tool with the -p command line argument:

-p (Linux):

Process: Show which processes are using which sockets (similar to -b under Windows). You must be root to do this.

The example section gives this example:

To display all ports open by a process with id $PID :

How to find ports opened by process ID in Linux?, Add a comment. 10. As a side note, netstat -ao will read the /proc/ PID /tcp etc to see the ports opened by the process. This means that its reading information supplied by the system (the linux KERNEL), and is in no way directly looking on the network interface or other means. Same goes for lsof. Usage examplenetstat —all —program | grep ‘3265’Feedback

How to determine which process is using a port in Linux

I’m currently running RethinkDB on its default port, because if I point my browser to localhost:8080 I see the RethinkDB web interface:

I’d like to close RethinkDB and re-open it on another port using the —port-offset argument. However, so far I haven’t been able to close it from within Python using the conn.close() method.

Instead, I’d like to try a brute-force approach by simply killing the process using that port. I tried to determine which process that is by using netstat , but that doesn’t bring up any results:

kurt@kurt-ThinkPad:~$ netstat -a | grep 8080 kurt@kurt-ThinkPad:~$ 

How can I kill the RethinkDB process to make the port available again?

1. lsof -i:8080 2. kill $(lsof -t -i:8080) or 2 . kill -9 $(lsof -t -i:8080) 

Following Klaus D.’s comment, I determined the process using netstat -nlp :

kurt@kurt-ThinkPad:~$ netstat -nlp | grep 8080 (Not all processes could be identified, non-owned process info will not be shown, you would have to be root to see it all.) tcp 0 0 127.0.1.1:8080 0.0.0.0:* LISTEN 2229/rethinkdb tcp 0 0 127.0.0.1:8080 0.0.0.0:* LISTEN 2229/rethinkdb tcp6 0 0 ::1:8080 . * LISTEN 2229/rethinkdb 

• numeric (show numerical addresses instead of trying to determine symbolic host, port or usernames)
• listening (show only listening sockets (these are omitted by default))
• program (show the PID and name of the program to which each socket belongs)

Awesome answer @codespy . I did a bash file and wrote it like this.

!/bin/bash

And save it and script file.

And made executable by $chmod +x script_filename

Now I run just by entering ./script_filename

To find out the pid or all the info about particular port as by which accused

To kill the process or event

harshit@harshit:~/Desktop/edwin-diaz/cms$ lsof -i :4111 COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME node 9215 harshit 33u IPv6 297470 0t0 TCP *:4111 (LISTEN) harshit@harshit:~/Desktop/edwin-diaz/cms$ kill -9 9215 

How to determine which process is using a port in Linux, I’m currently running RethinkDB on its default port, because if I point my browser to localhost:8080 I see the RethinkDB web interface:. I’d like to close RethinkDB and re-open it on another port using the —port-offset argument. However, so far I haven’t been able to close it from within Python using the conn.close() …

Источник