lsof and tcp port opened by rpcbind

[dl1963tw]

One strange thing for lsof and tcp port opened by rpcbind when using in HP-UX 11.11 and 11.23, please

refe to the following:

# uname -a
HP-UX hpux1 B.11.11 U 9000/785 2008042368 unlimited-user license

# rpcinfo -p | grep rpcbind
100000 4 tcp 111 rpcbind
100000 3 tcp 111 rpcbind
100000 2 tcp 111 rpcbind
100000 4 udp 111 rpcbind
100000 3 udp 111 rpcbind
100000 2 udp 111 rpcbind

# netstat -an | grep '\*.111'
tcp 0 0 *.111 *.* LISTEN
udp 0 0 *.111 *.*

# lsof -i -P | grep ':111'

>>> No output

# uname -a
HP-UX hpux2 B.11.23 U ia64 2249887032 unlimited-user license

# rpcinfo -p | grep rpcbind
100000 4 tcp 111 rpcbind
100000 3 tcp 111 rpcbind
100000 2 tcp 111 rpcbind
100000 4 udp 111 rpcbind
100000 3 udp 111 rpcbind
100000 2 udp 111 rpcbind

# netstat -an | grep '\*.111'
tcp 0 0 *.111 *.* LISTEN
udp 0 0 *.111 *.*

# lsof -i -P | grep ':111'

>>> No output

# uname -a
HP-UX hpux3 B.11.31 U ia64 2249887032 unlimited-user license

# rpcinfo -p | grep rpcbind
100000 4 tcp 111 rpcbind
100000 3 tcp 111 rpcbind
100000 2 tcp 111 rpcbind
100000 4 udp 111 rpcbind
100000 3 udp 111 rpcbind
100000 2 udp 111 rpcbind

# netstat -an | grep '\*.111'
tcp 0 0 *.111 *.* LISTEN
udp 0 0 *.111 *.*

/# lsof -i -P | grep ':111'
rpcbind 1539 root 3u IPv4 0xe000000332d30580 0t0 UDP *:111 (Idle)
rpcbind 1539 root 6u IPv4 0xe000000332d31480 0t0 TCP *:111 (LISTEN)

>>> Only HP-UX 11.31 lsof can get TCP *:111 (LISTEN)

And the following is the lsof for rpcbind in HP-UX 11.11 and 11.23:

11.11

# ps -ef | grep rpcbind
root 696 1 0 Nov 24 ? 0:00 /usr/sbin/rpcbind
hputaix1:/# lsof -p 696
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
rpcbind 696 root cwd DIR 64,0x3 8192 2 /
rpcbind 696 root txt REG 64,0x3 73728 104055 / (/dev/vg00/lvol3)
rpcbind 696 root mem REG 64,0x3 16384 8169 /usr/lib/libstraddr.1
rpcbind 696 root mem REG 64,0x3 135168 103910 /usr/lib/libxti.2
rpcbind 696 root mem REG 64,0x3 745472 18504 /usr/lib/libnsl.1
rpcbind 696 root mem REG 64,0x3 1822720 7115 /usr/lib/libc.2
rpcbind 696 root mem REG 64,0x3 24576 128811 /usr/lib/libdld.2
rpcbind 696 root mem REG 64,0x3 74000 61667 /opt/graphics/OpenGL/lib/libogltls.2
rpcbind 696 root mem REG 64,0x3 393216 128809 /usr/lib/dld.sl
rpcbind 696 root 0u CHR 3,0x2 0t0 256 /dev/null
rpcbind 696 root 1u CHR 3,0x2 0t0 256 /dev/null
rpcbind 696 root 2u CHR 3,0x2 0t0 256 /dev/null
rpcbind 696 root 3u FIFO 0x406b2048 0t0 119
rpcbind 696 root 4u STR 22,0x780001 0t0 164 /dev/udp->udpm->ip
rpcbind 696 root 5u STR 22,0x7c0001 0t0 164 /dev/udp->udpm->ip
rpcbind 696 root 6u STR 22,0x800001 0t0 164 /dev/udp->udpm->ip
rpcbind 696 root 7u STR 21,0x840001 0t0 166 /dev/tcp->tcpm->ip
rpcbind 696 root 8u STR 21,0x880001 0t0 166 /dev/tcp->tcpm->ip
rpcbind 696 root 9u STR 36,0x4 0t0 1743 /dev/tlclts->tlclts
rpcbind 696 root 10u STR 36,0x5 0t0 1743 /dev/tlclts->tlclts
rpcbind 696 root 11u STR 36,0x6 0t0 1743 /dev/tlclts->tlclts
rpcbind 696 root 12u STR 44,0x7 0t0 1749 /dev/tlcotsod->tlcotsod
rpcbind 696 root 13u STR 44,0x8 0t0 1749 /dev/tlcotsod->tlcotsod
rpcbind 696 root 14u STR 37,0x9 0t0 1744 /dev/tlcots->tlcots
rpcbind 696 root 15u STR 37,0xa 0t0 1744 /dev/tlcots->tlcots

>>> No TCP *:111 (LISTEN)

11.23:

# ps -ef | grep rpcbind
root 1277 1 0 Nov 24 ? 0:01 /usr/sbin/rpcbind
root 10230 9756 1 23:35:55 pts/0 0:00 grep rpcbind

# lsof -p 1277
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
rpcbind 1277 root cwd DIR 64,0x3 8192 2 /
rpcbind 1277 root txt REG 64,0x7 171740 6573 /usr (/dev/vg00/lvol7)
rpcbind 1277 root mem REG 64,0x6 302908 77506 /opt/star-ncf-prod/ep_patch/usr/lib/hpux32/libxti.so.1
rpcbind 1277 root mem REG 64,0x7 4645140 41140 /usr/lib/hpux32/libc.so.1
rpcbind 1277 root mem REG 64,0x7 1570840 39925 /usr/lib/hpux32/libnsl.so.1
rpcbind 1277 root mem REG 64,0x7 34616 1193 /usr (/dev/vg00/lvol7)
rpcbind 1277 root mem REG 64,0x7 76236 54827 /usr/lib/hpux32/libdl.so.1
rpcbind 1277 root mem REG 64,0x7 1066308 54826 /usr/lib/hpux32/dld.so
rpcbind 1277 root mem REG 64,0x7 176960 54829 /usr/lib/hpux32/uld.so
rpcbind 1277 root 0u CHR 3,0x2 0t0 72 /dev/null
rpcbind 1277 root 1u CHR 3,0x2 0t0 72 /dev/null
rpcbind 1277 root 2u CHR 3,0x2 0t0 72 /dev/null
rpcbind 1277 root 3u FIFO 0xe00000013cf44208 0t0 1042
rpcbind 1277 root 4u STR 18,0xd00000 0t0 22 /dev/udp->udpm->ip
rpcbind 1277 root 5u STR 18,0xd40000 0t0 22 /dev/udp->udpm->ip
rpcbind 1277 root 6u STR 18,0xd80000 0t0 22 /dev/udp->udpm->ip
rpcbind 1277 root 7u STR 20,0xdc0000 0t0 23 /dev/tcp->tcpm->ip
rpcbind 1277 root 8u STR 20,0xe00000 0t0 23 /dev/tcp->tcpm->ip
rpcbind 1277 root 9u STR 48,0x4 0t0 865 /dev/tlclts->tlclts
rpcbind 1277 root 10u STR 48,0x5 0t0 865 /dev/tlclts->tlclts
rpcbind 1277 root 11u STR 48,0x6 0t0 865 /dev/tlclts->tlclts
rpcbind 1277 root 12u STR 44,0x7 0t0 863 /dev/tlcotsod->tlcotsod
rpcbind 1277 root 13u STR 44,0x8 0t0 863 /dev/tlcotsod->tlcotsod
rpcbind 1277 root 14u STR 45,0x9 0t0 864 /dev/tlcots->tlcots
rpcbind 1277 root 15u STR 45,0xa 0t0 864 /dev/tlcots->tlcots

    Does anyone know why 11.11 and 11.23 lsof output can't find "TCP *:111 (LISTEN)"?

    Thanks a lot.

[Patrick Wallek]

Try searching for the ports with lsof.

lsof -i tcp:111

lsof -i udp:111

Will show any the processes accessing tcp/udp port 111.

[dl1963tw]

Hello Patrick:

    Thanks a lot to your reply, and the following is my tests in HP-UX 11.23

# /usr/local/bin/lsof -v
lsof version information:
    revision: 4.84
    latest revision: ftp://lsof.itap.purdue.edu/pub/tools/unix/lsof/
    latest FAQ: ftp://lsof.itap.purdue.edu/pub/tools/unix/lsof/FAQ
    latest man page: ftp://lsof.itap.purdue.edu/pub/tools/unix/lsof/lsof_man
    configuration info: PSTAT-based
    constructed: Wed Aug 25 17:48:51 BST 2010
    constructed by and on: root@valhalla
    compiler: /bin/cc
    compiler flags: -DHAS_CONST -DHPUXV=1123 -D_PSTAT64 -Ae +DD32 -DHASIPv6 -D_LARGEFILE64_SOURCE -DHAS_STRFTIME -DLSOF_VSTR="B.11.23" -O
    loader flags: -L./lib -llsof  -lnsl
    system info: HP-UX valhalla B.11.23 U ia64 0392673761 unlimited-user license
    Only root can list all files.
    /dev warnings are disabled.
    Kernel ID check is disabled.

>>> Version: 4.84

# /usr/local/bin/lsof -i tcp:111

/usr/local/bin/lsof -i udp:111

>>> Both have no outputs

HP-UX 11.11 gets the same result.

But 11.31 is workable:

lsof -v
lsof version information:
    revision: 4.84
    latest revision: ftp://lsof.itap.purdue.edu/pub/tools/unix/lsof/
    latest FAQ: ftp://lsof.itap.purdue.edu/pub/tools/unix/lsof/FAQ
    latest man page: ftp://lsof.itap.purdue.edu/pub/tools/unix/lsof/lsof_man
    configuration info: PSTAT-based
    constructed: Wed Aug 25 17:38:57 BST 2010
    constructed by and on: root@neon
    compiler: /bin/cc
    compiler flags: -DHAS_CONST -DHPUXV=1131 -D_PSTAT64 -Ae +DD32 -DHASIPv6 -D_PSTAT_STREAM_GET_XPORT -D_LARGEFILE64_SOURCE -DHAS_STRFTIME -DLSOF_VSTR="B.11.31" -O
    loader flags: -L./lib -llsof  -lnsl
    system info: HP-UX neon B.11.31 U ia64 3980317654 unlimited-user license
    Only root can list all files.
    /dev warnings are disabled.
    Kernel ID check is disabled.

# /usr/local/bin/lsof -i tcp:111
COMMAND  PID USER   FD   TYPE             DEVICE SIZE/OFF NODE NAME
rpcbind 1539 root    6u  IPv4 0xe000000332d31480      0t0  TCP *:portmap (LISTEN)
# /usr/local/bin/lsof -i udp:111
COMMAND  PID USER   FD   TYPE             DEVICE SIZE/OFF NODE NAME
rpcbind 1539 root    3u  IPv4 0xe000000332d30580      0t0  UDP *:portmap (Idle)

I make sure all of my lab machines for 11.11, 11.23 and 11.31 have rpcfind process running, but

only 11.31 can show output for lsof -i tcp:111 and lsof -i udp:111???

Best Regards

Danny

[dl1963tw · Accepted solution]

Solutin found, you can use xportshow from HP to solve this issue.