How to find process on a used port/socket.

[David W. Stacks]

All,

Thanks for taking the time to read my post. My question: Is there a way to find the PID of any given port/socket. I have tried the command echo "socket;quit" | kdbx /vmunix > tmp.file and looking for the PCB number. I have also looked at LSOF, but not much luck with these. Does anyone know of another way?

Thanks,

David Stacks

[Arch_Muthiah]

Dave,

There are tools in the net for this.

But you can try losf from the root. Also fuser and netstat with various options.


Archunan

[Ivan Ferreira]

I copied this once:

first, thanks for responding to the note.
I wasn't able to find the socket address with netstat command.
With netstat -A I get additional information, but also this additional address doesn't reflect the socketaddress.
If I just execute lsof command, I know it is the "DEVICE" number, if I look to another process where I'm able to find out the process number.
(not shure for what it stand for)

But finally I was able to find out the process number with your help!

I took the following procedure:
kdbx -k /vmunix
inpcb
(look for the interesting port, in my example we're looking for Port 3520)

Recv-Q Send-Q Local Address Foreign Address (state) Socket PCB OPTIONS
....
0 0 *.3520 *.* LISTEN k0x4fb1e700 k0x9cb0d2c0
...
(Now we have the right socket address: k0x4fb1e700)

socket
...
[Process ID: 2800] <== process which is running on Port 3520
k0x7533d580 k0x9abe3880 STRM k0x75ae6e00 0 0 0 0
k0x9e746a80 k0xf6b80a80 STRM k0x9b1cb880 0 0 0 0
k0xf1513840 k0x82136fc0 STRM k0x2a35f6c0 0 0 0 0
k0xe8f01f40 k0x1a6c01c0 STRM k0x0e6f2700 0 0 0 0
k0xd613e140 k0xb43556c0 STRM k0xb81ef500 0 0 0 0
k0x96cf1700 k0x4fb1e700 STRM k0x4fb1f6c0 0 20 0 0 <== look for socket address
k0x96cf03c0 k0xf6b59a40 STRM NULL 0 0 0 0
....

cda
ps | grep 2800
2800 java <== it is a java process which owns suspected port 3520

cheers

[Al Licause]

Something else to consider if you are looking for a PID corresponding to a network port number in a cluster. If the host is a cluster member, you need to look on all cluster members to find a particular socket/PID combination.

[Victor Semaska_3]

David,

With lsof, if you know the port number, the command would be:

# lsof -i:

This will give you the processes that have that port open.

Vic

[David Gutierrez_4]

David,
From the same place you have downloaded lsof, there used to be a file called lslk which will give you all the network information.
Maybe someone in the group has an old binary so you can compile it and run it.

David

[Zarar Siddiqi]

fuser -n tcp 8080

Will tell you the id of the process that is using TCP port 8080.

fuser -n udp 514

Does the same for UDP.