cancel
Showing results for 
Search instead for 
Did you mean: 

Unknown process holds TCP/9000

Pernat1y
Occasional Collector

Unknown process holds TCP/9000

Hello

 

Yet another topic on how to identify process, that binded specified port  :)

 

netstat shows that port TCP/9000 is in LISTEN state (i can connect with telnet to it, but no banner shown):

root@srv:/ # netstat -an | grep 9000
tcp 0 0 *.9000 *.* LISTEN

root@srv:/ #

lsof says nothing:

root@srv:/ # lsof -i | grep 9000
root@srv:/ # lsof -nP -i tcp:9000

root@srv:/ #

 

And there are no such entries in /etc/services nor /etc/inetd.conf (i have tried to stop inetd too, port still binded):

root@srv:/ # grep 9000 /etc/inetd.conf
root@srv:/ # grep 9000 /etc/services
root@srv:/ #

 

PS. This is HP-UX 11i v3, September 2012 on pa-risc box.

 

 

P.S. This thread has been moved from HP-UX > System Administration to HP-UX > networking. - Hp Forum Moderator

2 REPLIES
Patrick Wallek
Honored Contributor

Re: Unknown process holds TCP/9000

I think your version of lsof may have a problem.

 

I was doing some testing on one of my servers.

 

See below:

 

# netstat -an | grep 2049
tcp 0 0 *.2049 *.* LISTEN
udp 0 0 *.2049 *.*


# lsof | grep 2049
# lsof -i tcp:2049

# lsof -i udp:2049
# lsof -i :2049

# lsof -v
lsof version information:
revision: 4.84

<...snip...>

 

I then researched to see if there is a newer version of lsof and there is.  I downloaded and installed lsof version 4.87 from the HP-UX porting and archive centre ( http://hpux.connect.org.uk/hppd/hpux/Sysadmin/lsof-4.87/ ).

 

Now the results are:

 

# lsof -v
lsof version information:
revision: 4.87

<...snip...>

 

# lsof -i tcp:2049
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
nfsd 2407 root 6u IPv4 0x11873fdc00 0t0 TCP *:nfsd (LISTEN)

 

# lsof -i udp:2049
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
nfsd 2407 root 5u IPv4 0x11874bd100 0t0 UDP *:nfsd (Idle)

 

# lsof -i :2049
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
nfsd 2407 root 5u IPv4 0x11874bd100 0t0 UDP *:nfsd (Idle)
nfsd 2407 root 6u IPv4 0x11873fdc00 0t0 TCP *:nfsd (LISTEN)

 

So, you might consider installing a new version of lsof if yours is not 4.87 and then see what results you get.  The install does NOT require a reboot of the server.

 

Pernat1y
Occasional Collector

Re: Unknown process holds TCP/9000

Thank you for quick reply.

 

I have updated to lsof 4.87 and it works fine (previously i have version 4.82.001 from "HP-UX Internet Express for HP-UX 11i v3"). Sort of funny to see externals build works better then official :)

 

root@srv:/ # lsof -i tcp:9000
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
rpc.statd 1930 daemon 7u IPv4 0x12cb575780 0t0 TCP *:9000 (LISTEN)

 

Looks like the daemon was hanging because "/usr/sbin/rpc.statd stop" doesnt stop it at all.

 

After kill and restart via "/usr/sbin/rpc.statd start" it works fine