Unknown process holds TCP/9000

[Pernat1y]

Hello

Yet another topic on how to identify process, that binded specified port  :)

netstat shows that port TCP/9000 is in LISTEN state (i can connect with telnet to it, but no banner shown):

root@srv:/ # netstat -an | grep 9000
tcp 0 0 *.9000 *.* LISTEN

root@srv:/ #

lsof says nothing:

root@srv:/ # lsof -i | grep 9000
root@srv:/ # lsof -nP -i tcp:9000

root@srv:/ #

And there are no such entries in /etc/services nor /etc/inetd.conf (i have tried to stop inetd too, port still binded):

root@srv:/ # grep 9000 /etc/inetd.conf
root@srv:/ # grep 9000 /etc/services
root@srv:/ #

PS. This is HP-UX 11i v3, September 2012 on pa-risc box.

P.S. This thread has been moved from HP-UX > System Administration to HP-UX > networking. - Hp Forum Moderator

[Patrick Wallek]

I think your version of lsof may have a problem.

I was doing some testing on one of my servers.

See below:

# netstat -an | grep 2049
tcp 0 0 *.2049 *.* LISTEN
udp 0 0 *.2049 *.*

# lsof | grep 2049
# lsof -i tcp:2049

# lsof -i udp:2049
# lsof -i :2049

# lsof -v
lsof version information:
revision: 4.84

<...snip...>

I then researched to see if there is a newer version of lsof and there is.  I downloaded and installed lsof version 4.87 from the HP-UX porting and archive centre ( http://hpux.connect.org.uk/hppd/hpux/Sysadmin/lsof-4.87/ ).

Now the results are:

# lsof -v
lsof version information:
revision: 4.87

<...snip...>

# lsof -i tcp:2049
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
nfsd 2407 root 6u IPv4 0x11873fdc00 0t0 TCP *:nfsd (LISTEN)

# lsof -i udp:2049
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
nfsd 2407 root 5u IPv4 0x11874bd100 0t0 UDP *:nfsd (Idle)

# lsof -i :2049
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
nfsd 2407 root 5u IPv4 0x11874bd100 0t0 UDP *:nfsd (Idle)
nfsd 2407 root 6u IPv4 0x11873fdc00 0t0 TCP *:nfsd (LISTEN)

So, you might consider installing a new version of lsof if yours is not 4.87 and then see what results you get.  The install does NOT require a reboot of the server.

[Pernat1y]

Thank you for quick reply.

I have updated to lsof 4.87 and it works fine (previously i have version 4.82.001 from "HP-UX Internet Express for HP-UX 11i v3"). Sort of funny to see externals build works better then official :)

root@srv:/ # lsof -i tcp:9000
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
rpc.statd 1930 daemon 7u IPv4 0x12cb575780 0t0 TCP *:9000 (LISTEN)

Looks like the daemon was hanging because "/usr/sbin/rpc.statd stop" doesnt stop it at all.

After kill and restart via "/usr/sbin/rpc.statd start" it works fine