Hey all, I'm trying to stop all the services on port 80 by I'm not entirely sure how.

Infact, I don't really know what's running on port 80... I tried throwing a netstat -a in a prompt but I don't see port numbers anywhere so I can't figure out which PID to kill.

Any ideas on how I can figure out what's running on port 80, and stop it?

Thanks,

Phoebe

Port 80 is usually HTTP, as in Apache or web services. Since you don't say what version/distro of Linux you're using, we'll have to guess as to how to stop it. Normally /etc/init.d/apache2 stop, as root.

You can see all tcp and udp connections with the pid using them with

I tried,

And I get,

"Stopping web server: apache2apache2: Could not reliably determine the server's fully qualified domain name, using 127.0.1.1 for ServerName."

Running netstat -tupn, I get the following:

Active Internet connections (w/o servers)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 192.168.194.128:48544 69.63.189.39:80 TIME_WAIT -
tcp 0 0 127.0.0.1:41402 127.0.0.1:80 TIME_WAIT -

I'm not sure what to kill, are the PID's 48544 and 41402?

Thanks again,

Phoebe

The TIME_WAIT status means that those connections are shutting down (because you shut down the apache server). If you run the netstat command again, they should disappear.

I checked it again and got the following:

Active Internet connections (w/o servers)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name

So it looks like it did disappear. However, when I tried to run the program which wasn't working in the first place (since port 80 was in use) it still gave me an error. After recieveing the error, I threw another netstat -tupn command out and it looks like it came back:

"Active Internet connections (w/o servers)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 192.168.194.128:48544 69.63.189.39:80 TIME_WAIT -
tcp 0 0 127.0.0.1:41402 127.0.0.1:80 TIME_WAIT -"

Any ideas what's going on here?

I suggest that you check your log file (/var/log/syslog or /var/log/messages;the location depends on your distribution) and the kernel messages (dmesg) to see if the failing program is giving any indication about the failure.

Why don't you block all services on 80 with iptables.

the command you are looking for is

-p shows program info
-a shows all listening sockets, not just open ones
-n shows port numbers instead of service names

for future reference, info is a very useful command:

gives a lot of assistance. I know, I've just used it!

So

gives me this:

which tells me that it is the httpd process that is running listening to port 80 (any IP to any IP) and it's that that I would need to shut down.

Here's what I get:

"root@bt:~# netstat -pan | grep :80
tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN 6216/python
root@bt:~# service python stop
python: unrecognized service"

How come it sees python as an unrecognized service?

Because python is a programming language not a service. Chances are you've got some other sort of program running on this box, that's using port 80, and it's written in Python.

EDIT: Figured it out!

Thanks alot guys.

Execute the following command as root. It might help you track down who launched the Python application. You can decide from there if you want to kill it.

What was the solution?? If you post it, everyone in the community can benefit.

Yes, sorry, I should have made it clearer that the output wouldn't necessarily be a service. The number appearing before that (6216 in this case) would be the process id, so you probably found out that you could just to stop the program from running.

would have shown the process and the user under which it was running