How to find what process is listening on a certain port?

laredotornado · 08-08-2011, 11:03 AM

Hi,

I'm using Ubuntu Linux 11.04. I want to figure out what process is listening on port 4444. I tried the following, but it lists a bunch of processes, and only one can listen on port 4444 ...

Code:

selenium@selenium:~$ lsof -w -n -i tcp:4444 -F ''
p3404
p5129
p5696
p7338
p15027
p26072
p27894

Ideally, I could just run a command that would return a single process ID. Any ideas how to modify the above or know of a different command to use? - Dave

corp769 · 08-08-2011, 11:12 AM

Hello,

There are a few ways to do this, but I like using lsof most of the time, just like you did.

Code:

lsof +M -i4

Take a look at the man page if you want to know more about the lsof command.

Code:

man lsof

Cheers,

Josh

eSelix · 08-08-2011, 12:46 PM

Also

Code:

netstat -lp --numeric-ports --protocol=inet | grep :4444

can be handy.

laredotornado · 08-09-2011, 08:35 AM

Hi,

eSelix, I tried your solution, but didn't get my process ID, only

Code:

netstat -lp --numeric-ports --protocol=inet | grep :4444
(Not all processes could be identified, non-owned process info
 will not be shown, you would have to be root to see it all.)

However, I'm successfully able to "telnet localhost 4444" and the process runs as a non-root user. I'm using bash shell, Ubuntu 11.04. Does your solution apply to some other setup?

Josh, What were you trying to show with "lsof +M -i4"? That doesn't show me my process that is listening on 4444.

Thanks, - Dave

eSelix · 08-09-2011, 10:25 AM

This is only warning, root is not neccessary for showing your own processes. This is corrected version:

Code:

netstat -lp --numeric-ports --protocol=inet 2>&1 | grep :4444

But in your example "telnet localhost 4444" the port 4444 is not opened by you, you only connect to it. Another program opened it.

corp769 · 08-09-2011, 11:31 AM

Quote:

Josh, What were you trying to show with "lsof +M -i4"? That doesn't show me my process that is listening on 4444.

Thanks, - Dave

That was me failing to show you how to do it a different way

I normally use just the -i flag with lsof, but the +M -i4 was something that I was experimenting with a few days ago, and completely forgot that it doesn't show the actual numerical value of the port for the service on your system.

XavierP · 08-09-2011, 11:35 AM

Moved to Linux-General

laredotornado · 08-09-2011, 01:10 PM

Hi eSelix, Thanks for sending an updated command but when I ran it, I didn't get any results ...

Code:

$ netstat -lp --numeric-ports --protocol=inet 2>&1 | grep :4444
$

I used the "telnet localhost 4444" to demonstrate that there was a process running on the machine listening at 4444, so theoretically, the command above should have returned its process id.

Thanks for any additional advice, - Dave

eSelix · 08-09-2011, 03:53 PM

For me it works, and show PID in second column:

Code:

lsof -i:4444

and your command from first post also works as expected.

So, what is your output of:

Code:

netstat -lp --numeric-ports --protocol=inet
lsof -w -n -i tcp:4444

laredotornado · 08-10-2011, 08:15 AM

Hi, Here is the output I get from running the commands you suggested.

Code:

selenium@selenium:~$ netstat -lp --numeric-ports --protocol=inet
(Not all processes could be identified, non-owned process info
 will not be shown, you would have to be root to see it all.)
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      -               
tcp        0      0 127.0.0.1:631           0.0.0.0:*               LISTEN      -               
tcp        0      0 0.0.0.0:6015            0.0.0.0:*               LISTEN      3399/Xvfb       
udp        0      0 216.18.94.109:123       0.0.0.0:*                           -               
udp        0      0 127.0.0.1:123           0.0.0.0:*                           -               
udp        0      0 0.0.0.0:123             0.0.0.0:*                           -               
udp        0      0 216.18.94.255:137       0.0.0.0:*                           -               
udp        0      0 216.18.94.109:137       0.0.0.0:*                           -               
udp        0      0 0.0.0.0:137             0.0.0.0:*                           -               
udp        0      0 216.18.94.255:138       0.0.0.0:*                           -               
udp        0      0 216.18.94.109:138       0.0.0.0:*                           -               
udp        0      0 0.0.0.0:138             0.0.0.0:*                           -               
udp        0      0 0.0.0.0:5353            0.0.0.0:*                           -               
udp        0      0 0.0.0.0:33086           0.0.0.0:*                           -               
selenium@selenium:~$ 
selenium@selenium:~$ 
selenium@selenium:~$ 
selenium@selenium:~$ lsof -w -n -i tcp:4444
COMMAND   PID     USER   FD   TYPE   DEVICE SIZE/OFF NODE NAME
java    26439 selenium   10u  IPv6 18273130      0t0  TCP *:4444 (LISTEN)
selenium@selenium:~$ 
selenium@selenium:~$ 
selenium@selenium:~$ lsof -i:4444
COMMAND   PID     USER   FD   TYPE   DEVICE SIZE/OFF NODE NAME
java    26439 selenium   10u  IPv6 18273130      0t0  TCP *:4444 (LISTEN)
selenium@selenium:~$

I'm using bash shell, if that matters, - Dave

eSelix · 08-10-2011, 03:46 PM

So "lsof" works for you too. For "netstat" I don't known why ipv6 is not displayed, as I am not using it. Maybe this is by option "--protocol=inet" or you can add option "-6"

frankbell · 08-10-2011, 08:51 PM

cat /etc/services | grep 4444 works to tell me which services are configured to listen on port 4444.

It reports this on CentOS.

Code:

cat /etc/services | grep 4444
krb524          4444/tcp                        # Kerberos 5 to 4 ticket xlator
krb524          4444/udp                        # Kerberos 5 to 4 ticket xlator

On Debian, it reports nothing. Reading /etc/services in Debian verifies that nothing was configured to listen on port 4444. Rather, in Debian, kerberos is configured to listen on ports 88, 749, 750, and 751.

laredotornado · 08-11-2011, 08:02 AM

Hi, Thanks for that, but I didn't register my process as a service, so nothing is appearing. Not to lose sight of what I was originally looking for, I just need an expression that will return the PID (and nothing else), of the process running on port 4444.

Thanks to all, - Dave

Silomor · 11-25-2017, 07:26 PM

Nothing happens stoping on this screen, how to run? When im running eggshell

Habitual · 11-27-2017, 06:09 PM

How to find out which process is listening upon a port

Linux: Find Out Which Process Is Listening Upon a Port