How to find out what port foreign ip is using

the_mulletator · 10-05-2009, 11:45 AM

Hi,

How can I find out what port is being used by a specific ip address? I often see a lot of traffic on one connection using iftop and I'd like to know more about it.

Thanks

{BBI}Nexus{BBI} · 10-05-2009, 12:11 PM

Netstat should help. I like to use netstat -tan. There's many other switches available. Type man netstat for a comprehensive list of arguments.

anomie · 10-05-2009, 01:06 PM

You might eliminate the -a option (which will also include LISTENING state) and just use:
$ netstat -tn

You can get local program information (as root) with:
# netstat -tnp

unSpawn · 10-05-2009, 04:21 PM

Netstat still requires a grep to narrow things down if you got pages of output. While not that intuitive for most the 'lsof' or 'fuser' may provide easier selectors. For example finding all local VNC ports: 'fuser -n tcp vnc' or all TCP/22 ports: 'lsof -Pnai tcp:22'. Note both take numerical ports as well as /etc/services type names (as in 'getent services portnumber').

hackertarget · 10-05-2009, 09:27 PM

The fastest way is to use netstat -n with grep.

Quote:

netstat -n | grep 999.999.999.999

No need to complicate things.