How to find out which process is using some port

root's picture

With netstat and -p option (the pid may not be shown if the command is not executed from the user which runs the process):


venus:~# netstat -tlnp | grep -w 25
tcp        0      0 0.0.0.0:25              0.0.0.0:*               LISTEN      2931/tcpserver  
venus:~# ps wwu 2931
USER       PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
vpopmail  2931  0.0  0.1   5912   564 ?        S    May02   0:00 /usr/local/bin/tcpserver -v -R -l gz.ro -x /etc/tcp.smtp.cdb -c 30 -u 1016 -g 1011 0 smtp /var/qmail/bin/qmail-smtpd mail.gz.ro /home/vpopmail/bin/vchkpw /usr/bin/true

With netstat and rmsock:


root@gz~# netstat -Aan|grep 25 | grep LISTEN
f100060003582398 tcp4       0      0  *.25               *.*                LISTEN
root@gz~# rmsock f100060003582398 tcpcb
The socket 0x3582008 is being held by proccess 385234 (smtp).
root@gz~# ps -ef | grep 385234 | grep -v grep
   notes  385234   78038   3   Nov 06      - 15:08 /opt/ibm/lotus/notes/latest/ibmpow/smtp 

With lsof:


root@gz~# lsof -i :25 | grep LISTEN
smtp    385234 notes   10u  IPv4 0xf100060003582398      0t0  TCP *:smtp (LISTEN)
root@gz~# ps -ef | grep 385234 | grep -v grep
   notes  385234   78038   1   Nov 06      - 15:08 /opt/ibm/lotus/notes/latest/ibmpow/smtp 

With socklist. In socklist the second column is showing the port and on 5th you have the pid:


root@gz~# socklist | awk '{if($2=="25") print $0}'
tcp     25       6930       0   385234    3  notes
root@gz~# ps -ef | grep 385234 | grep -v grep
   notes  385234   78038   1   Nov 06      - 15:08 /opt/ibm/lotus/notes/latest/ibmpow/smtp 

Thou shalt not steal!

If you want to use this information on your own website, please remember: by doing copy/paste entirely it is always stealing and you should be ashamed of yourself!
Have at least the decency to create your own text and comments and run the commands on your own servers and provide your output, not what I did!

Or at least link back to this website.