"lsof -i" and "netstat -an"

[yc_2]

Hi,

Correct me if I'm wrong that
"lsof -i tcp:49153" is the same as
"netstat -an | grep 49153" ?

If so, why there was no output when I did
"lsof -i tcp:49153"

but when I did "netstat -an | grep 49153" I got the following:

tcp 0 0 *.49153 *.* LISTEN

Appreciate any advice.

[Jerome Baron]

Hi

You are right. On my system :
# netstat -an | grep 49152
tcp 0 0 IP.49159 IP.49152 ESTABLISHED
tcp 0 0 *.49152 *.* LISTEN
tcp 0 0 IP.49152 IP.49159 ESTABLISHED
# lsof -i tcp:49152
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
rpc.statd 591 root 3u inet 72,0xb 0t0 TCP *:49152 (LISTEN)
rpc.statd 591 root 7u inet 72,0xb 0t0 TCP host:49159->host:49152 (ESTABLISHED)

Have you a good lsof version ?

Regards,
Jerome

[Michael Tully]

You can the 64 bit version from here:

http://www.wiretapped.net/security/host-security/lsof/binaries/hpux/B.11.11/

32 bit version from here:
http://hpux.connect.org.uk/hppd/hpux/Sysadmin/lsof-4.64/

[yc_2]

Hi,

I removed the current version of lsof and downloaded and installed the lsof-4.64 but the result still the same.

Anyway, how do I know what application is using the port and how do stop it from listening ? My auditor is chasing me.


Thanks in advance,
YC

[Jerome Baron]

you can try lsof -n |grep 49153

Jerome

[yc_2]

Hi Jerome,

Sorry to say the prompt just come back without any result.

[Jerome Baron]

does the lsof on an another port give you a correct output ?

Regards,
Jerome

[Ron Kinner]

I did a quick search with google for tcp port 49153 and found the following possibilities. Are any of these running on your box?

ASAS Server?

http://www.arpage.ch/arpage/asas3/s-unxinst.html

BIND-9?

http://mail-index.netbsd.org/tech-security/2002/02/22/0002.html

Radiator?

http://www.open.com.au/archives/radiator/2001-07/msg00010.html


NAT?

http://www.mail-archive.com/isp-linux@isp-linux.com/msg00553.html

/etc/ipnat?
http://www.jp.daemonnews.org/200109/daemonnews200109.pdf

giotic?

http://www-cad.eecs.berkeley.edu/~fresco/giotto/download/distribution/INSTALL

Mservers?

http://www.cwi.nl/~windhouw/public/afstuderen/programma/tcpip.body.html

Secure Connectionless WAP Browser Proxy Server?

http://www.4k-associates.com/4K-Associates/IEEE-L7-WAP-BIG.html

snmps?

http://www.mail-archive.com/intermapper-talk@list.dartware.com/msg00162.html

Ron

[rick jones]

lsof and netstat are _similar_ but not the same. lsof is trying to lookup much more than netstat reports. perhaps it does not always get it right.

i would make sure that you compile lsof on the system on which you wish to use it to make sure that the binary you use matches the kernel you are running (btw, you did boot off /stand/vmunix yes?)

also, try lsof against some other port numbers and see if it "works" there.