LinuxQuestions.org
Visit Jeremy's Blog.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Server
User Name
Password
Linux - Server This forum is for the discussion of Linux Software used in a server related context.

Notices

Reply
 
Search this Thread
Old 05-07-2007, 02:13 AM   #1
zkjian
LQ Newbie
 
Registered: May 2004
Posts: 7

Rep: Reputation: 0
How to get responding processes of those ports?


can anyone tell me how to get the processes which opened the following ports and the files opened by these processes?

------------------------------------------------------------
[root@rac1 ~]# netstat -lnp | grep - | grep :
tcp 0 0 0.0.0.0:2049 0.0.0.0:* LISTEN -
tcp 0 0 0.0.0.0:32861 0.0.0.0:* LISTEN -
udp 0 0 0.0.0.0:2049 0.0.0.0:* -
udp 0 0 0.0.0.0:6199 0.0.0.0:*
-----------------------------------------------------------

lsof -i | egrep '2049|32861:6199' give me nothing.

thanks
 
Old 05-07-2007, 02:38 AM   #2
bathory
Guru
 
Registered: Jun 2004
Location: Piraeus
Distribution: Slackware
Posts: 10,883

Rep: Reputation: 1322Reputation: 1322Reputation: 1322Reputation: 1322Reputation: 1322Reputation: 1322Reputation: 1322Reputation: 1322Reputation: 1322Reputation: 1322
You can use:
Code:
netstat -tunapl|grep LISTEN
as well as
Code:
lsof|grep LISTEN
 
Old 05-07-2007, 05:51 AM   #3
zkjian
LQ Newbie
 
Registered: May 2004
Posts: 7

Original Poster
Rep: Reputation: 0
thank you for your kind help, but still no display.
 
Old 05-07-2007, 08:18 AM   #4
bathory
Guru
 
Registered: Jun 2004
Location: Piraeus
Distribution: Slackware
Posts: 10,883

Rep: Reputation: 1322Reputation: 1322Reputation: 1322Reputation: 1322Reputation: 1322Reputation: 1322Reputation: 1322Reputation: 1322Reputation: 1322Reputation: 1322
That's strange. What distro are you using? What is the output of:
Code:
lsof -i -n -P
 
Old 05-07-2007, 11:51 PM   #5
zkjian
LQ Newbie
 
Registered: May 2004
Posts: 7

Original Poster
Rep: Reputation: 0
RHEL4

[root@lb1 ~]# netstat -lnp | grep : | grep -
tcp 0 0 0.0.0.0:32800 0.0.0.0:* LISTEN -
udp 0 0 0.0.0.0:32770 0.0.0.0:* -
[root@lb1 ~]# lsof -i -n -P | grep 32800
[root@lb1 ~]# lsof -i -n -P | grep 32770
[root@lb1 ~]# netstat -tunapl | grep LISTEN | grep 32
tcp 0 0 0.0.0.0:32800 0.0.0.0:* LISTEN -
[root@lb1 ~]# netstat -tunapl | grep 32800
tcp 0 0 0.0.0.0:32800 0.0.0.0:* LISTEN -
[root@lb1 ~]# netstat -tunapl | grep 32770
udp 0 0 0.0.0.0:32770 0.0.0.0:* -
[root@lb1 ~]# lsof | grep LISTEN | grep 32800
 
Old 05-08-2007, 02:21 AM   #6
bathory
Guru
 
Registered: Jun 2004
Location: Piraeus
Distribution: Slackware
Posts: 10,883

Rep: Reputation: 1322Reputation: 1322Reputation: 1322Reputation: 1322Reputation: 1322Reputation: 1322Reputation: 1322Reputation: 1322Reputation: 1322Reputation: 1322
It's indeed strange. Here is the output of the same commands in my Slackware box running squid:
Code:
netstat -tunapl | grep 32768
udp        0      0 0.0.0.0:32768           0.0.0.0:*                          1300/(squid)

lsof -i -n -P|grep 32768
squid      1300  squid    5u  IPv4   2353       UDP *:32768
If you suspect something use a live CD to scan your system for rootkits.
 
Old 05-08-2007, 03:21 AM   #7
zkjian
LQ Newbie
 
Registered: May 2004
Posts: 7

Original Poster
Rep: Reputation: 0
not all service will hide his process name/PID,
just some special ones will do that, please see the following
example:

[root@lb1 ~]# /etc/init.d/nfs start
启动 NFS 服务:
[ 确定 ]
关掉 NFS 配额:[ 确定 ]
启动 NFS 守护进程:[ 确定 ]
启动 NFS mountd:[ 确定 ]
[root@lb1 ~]#
[root@lb1 ~]# netstat -lnp | grep : | grep -
tcp 0 0 0.0.0.0:32800 0.0.0.0:* LISTEN -
tcp 0 0 0.0.0.0:2049 0.0.0.0:* LISTEN -
udp 0 0 0.0.0.0:2049 0.0.0.0:* -
udp 0 0 0.0.0.0:32770 0.0.0.0:* -
[root@lb1 ~]#
[root@lb1 ~]# lsof | grep 2049
[root@lb1 ~]#
[root@lb1 ~]# /etc/init.d/nfs stop
关闭 NFS mountd:[ 确定 ]
关闭 NFS 守护进程:[ 确定 ]
关闭 NFS quotas:[ 确定 ]
关闭 NFS 服务: [ 确定 ]
[root@lb1 ~]# netstat -lnp | grep : | grep -
tcp 0 0 0.0.0.0:32800 0.0.0.0:* LISTEN -
udp 0 0 0.0.0.0:32770 0.0.0.0:* -
[root@lb1 ~]#

i know it's certain service related to nfs which opened the port 2049,but i can't get which one(the process/PID) opened the port on
earth.
one of my partners told me it's the kernel which opens those ports
whose process name/PID are identified by -, such as nfs.
what do you think about his words?
 
Old 05-08-2007, 04:49 AM   #8
bathory
Guru
 
Registered: Jun 2004
Location: Piraeus
Distribution: Slackware
Posts: 10,883

Rep: Reputation: 1322Reputation: 1322Reputation: 1322Reputation: 1322Reputation: 1322Reputation: 1322Reputation: 1322Reputation: 1322Reputation: 1322Reputation: 1322
You're right that nfsd is using those ports. Running
Code:
rpcinfo -p
will verify that these ports are used by nfsd.
Quote:
one of my partners told me it's the kernel which opens those ports
whose process name/PID are identified by -, such as nfs.
what do you think about his words?
You can say this, since nfs support is built in the kernel.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Limitations of System Processes and Oracle Processes in RHEL AS3.0 sathyguy Linux - Enterprise 0 03-02-2007 11:52 PM
What command can identify processes running on ports? hello321_1999 Linux - Newbie 2 11-23-2004 05:01 AM
monitoring active processes and identifying the required processes. gajaykrishnan Programming 2 08-13-2004 01:58 AM
Processes and Ports Mike_the_Man Solaris / OpenSolaris 4 04-07-2004 08:07 PM
Ports and processes fmhermo Linux - General 2 10-18-2003 08:06 AM


All times are GMT -5. The time now is 01:35 PM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration