topic Re: Which process is bound to tcp socket in Operating System - HP-UX

Which process is bound to tcp socket

Brandon Poyner — Mon, 14 Nov 2005 09:54:49 GMT

After rebooting our rp7410 (hp-ux 11.11) system something has bound to tcp port 992 before inetd could claim it for another service we provide.

netstat can see something listening on 992, telnet confirms it, but 'lsof -i :992' returns nothing. I've tried multiple versions of lsof, tried using it without any arguments and piping through grep, nothing is returned. Any suggestions for tracking this one down? Thanks.

# netstat -an | grep LISTEN | grep 992
tcp 0 0 *.992 *.*
LISTEN

# telnet localhost 992
Trying...
Connected to localhost.
Escape character is '^]'.
help
Connection closed by foreign host.

Re: Which process is bound to tcp socket

Steven E. Protter — Mon, 14 Nov 2005 09:57:54 GMT

Hello Brandon,

A utility called lsof might help.

http://hpux.connect.org.uk/hppd/hpux/Sysadmin/lsof-4.75/

SEP

Re: Which process is bound to tcp socket

Doug O'Leary — Mon, 14 Nov 2005 10:01:35 GMT

Hey;

It sounds like the inetd daemon is listening on that port. Try telnetting to the port and leave the connection open, then use the "lsof -i :992"

HTH;

Doug

Re: Which process is bound to tcp socket

Brandon Poyner — Mon, 14 Nov 2005 10:04:54 GMT

Thanks, telneting to the port and lsof'ing confirmed that inetd is indeed the culprit.

Re: Which process is bound to tcp socket

Brandon Poyner — Mon, 14 Nov 2005 10:16:55 GMT

Ok, I was too quick to jump to conclusions there. The results from lsof weren't what I thought I was seeing because I was telneting to localhost. From another host I can telnet to port 992 and you can see the connection in netstat. I still don't see anything in lsof.

# netstat -an | grep 992
tcp 0 0 192.168.0.20.992 192.168.0.21.2337 ESTABLISHED
tcp 0 0 *.992 *.* LISTEN

# lsof -P | grep :992 | wc -l
0

Re: Which process is bound to tcp socket

Brandon Poyner — Mon, 14 Nov 2005 10:32:26 GMT

I found a similar thread in the Tru64 forum, the solution was run a debugger on the running kernel. Could something similar be done here?

http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=945634

Re: Which process is bound to tcp socket

Jeff Schussele — Mon, 14 Nov 2005 10:48:32 GMT

Hi Brandon,

According to IANA.org port 992 tcp/udp is as follows:

telnets 992/tcp telnet protocol over TLS/SSL
telnets 992/udp telnet protocol over TLS/SSL

Generally you don't want to use *any* port < 1024 because they all pre-assigned.

Here's where you can view them:

http://www.iana.org/assignments/port-numbers

HTH,
Jeff

Re: Which process is bound to tcp socket

Brandon Poyner — Mon, 14 Nov 2005 11:03:02 GMT

Correct, we are using a 3rd party telnets server that is served by inetd. However inetd is unable to bind to port 992 as something else is listening on 992. We then commented out our telnets line in inetd.conf, reloaded the configurating, and something is still listening on 992.

Nov 12 20:51:45 prod3 inetd[1779]: Reading configuration
...
Nov 12 20:51:45 prod3 inetd[1779]: telnets/tcp: bind: Address already in use
Nov 12 20:51:45 prod3 inetd[1779]: telnets/tcp: Added service, server /usr/ud61/
bin/udtelnetd
Nov 12 21:01:47 prod3 inetd[1779]: telnets/tcp: bind: Address already in use
Nov 12 21:01:47 prod3 inetd[1779]: telnets/tcp: Service enabled
Nov 12 21:11:47 prod3 inetd[1779]: telnets/tcp: bind: Address already in use
Nov 12 21:11:47 prod3 inetd[1779]: telnets/tcp: Service enabled
...
Nov 14 08:00:16 prod3 inetd[1779]: Rereading configuration
Nov 14 08:00:16 prod3 inetd[1779]: telnets/tcp: Deleted service
Nov 14 08:00:16 prod3 inetd[1779]: Thru with configuration
Nov 14 08:00:16 prod3 inetd[1779]: Configuration complete

Re: Which process is bound to tcp socket

Brandon Poyner — Mon, 14 Nov 2005 14:19:04 GMT

The answer is here is to use crashinfo. You have to request this from HP, there is no public download available. In our case it turns out rpc.yppasswdd had taken over the telnets port. It would be nice to know how to stop it from doing that in the future.