How to find the process that used a TCP/UDP port?

[discoverer]

Hi All,

Do you know how to find the process that used a TCP/UDP port?

E.g.
# netstat -a -n
...
UDP
...
*.161 Idle

How to find the process that used the 161 port?

Thanks for your attention!

/Listener

[Bill McNAMARA_1]

I would imagine lsof would do it..

see attached.

Bill

[Santosh Nair_1]

I believe lsof -i UDP:161 will tell you who's using the port, but I also believe that IDLE indicates that the port is open but not bound, i.e. not really being used.

-Santosh

[rick jones]

an unbound UDP endpoint would not have a port number associated with it and would appear as *.* not *.161

also, on 11.0 netstat -an shows nothing along the lines of "IDLE" or other states for a UDP endpoint. i don't see it in netstat -an output for 10.20 either.

[Santosh Nair_1]

My fault, I was looking at the man pages for a sun box and assumed it would be the same for HPUX.

-Santosh

[Shujaat Hussain]

Hi,

There is a cool utily available called "SAINT".
It is very helpful to scan the ports. Try it. You can find it at http://hpux.connect.org.uk.

Cheers.

[Jeffrey S. Sims]

Try this script:

#!/bin/sh

for pid in `ps -ef|grep -v UID|awk '{ print $2 }'| sort -rn`; do
/usr/sbin/lsof -p $pid|grep LISTEN
done

It was given to me on here. This should work for you.

[Varghese Mathew]

Hi,

Try this command...

#rpcinfo -p | grep tcp

Checkout the man pages of rpcinfo.

Hope this helps,

Cheers !!!
Mathew

[Wodisch · Accepted solution]

Hello Discoverer/Listener,

Bill's answer is the easiest to use (and you should have
"lsof" on your systems anyway), for a simple
lsof -i udp:161
would tell you, which process is using that port.

Then, UDP:161 is reserved for SNMP (Simple Network
Management Protocol), so I guess your process is the
SNMP agent (snmpd)...

HTH,
Wodisch

[discoverer]

Hello Wodisch & All,

Thank you very much, everybody!

The answer is just as Wodisch said: the 161 port is used by the snmp service. We can find the definition in /etc/services (only for HPUX, Solaris 2.6/2.8 haven't).

Anyway, I am very glad to have knowed more useful methods(lsof, saint, rpcinfo, etc), especially the famous 'lsof' that I knowed a year ago.


Thanks again, friends!

/Listener