The PID and name of the program to which socket belongs

Question

Using 'netstat -tulp' on my server box running under CentOS I have discovered strange listening ports 33363 (TCP) and 35661 (UDP). The thing is that 'PID/Program name' field for these ports contains nothing (dash actually). 'fuser -n tcp 33363' shows nothing. I have checked my box with chkrootkit and rkhunter utilities and it seems everything is O.K. Does anybody know what these sockets can be used for?

score 4 · Answer 1 · answered Jul 24 '09 at 08:15

4

Have you tried with lsof?

lsof -i TCP:33363
lsof -i UDP:35661

answered Jul 24 '09 at 08:15

scetoaux

1,289
2
12
26

Thanks for reply! Like 'fuser' 'lsof' gives an empty output. – user14241 Jul 24 '09 at 08:35
Pretty weird... You can also try to trace the pid and see if it shows something interesting: strace -p – scetoaux Jul 24 '09 at 08:58
1

What PID, Fran? – innaM Jul 24 '09 at 09:24
Doh! True, we do not know the pid. Thanks for pointing it out Manni :) – scetoaux Jul 24 '09 at 09:26
Unfortunately `lsof` seems to usable only by root. My process is running as user "foo". I am user "foo", can get no results. Stragen. The tool `nestat` shows the open ports. – guettli Feb 28 '17 at 08:02

score 1 · Answer 2 · answered Jul 24 '09 at 08:15

1

Did you run netstat -tulp as root?

answered Jul 24 '09 at 08:15

innaM

1,448
9
10

1

Could have been the reason for the missing pid. You never know ;-) – innaM Jul 24 '09 at 09:22

The PID and name of the program to which socket belongs

2 Answers2