8
developer@LinuxKernel:~> sudo netstat -elnopt
developer's password:
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       User       Inode       PID/Program name    Timer
tcp        0      0 0.0.0.0:10080           0.0.0.0:*               LISTEN      1003       3061421021 -                   off (0.00/0/0)

Regarding my experience, I have the authority to check the PID/Program name of netstat with sudo, how to explain this one, the kernel is 2.6.16.60, net-tools 1.6, netstat 1.42

http8086
  • 1,306
  • 16
  • 37
  • Maybe your `netstat` is a `#!/bin/sh` script. Check with `file $(which netstat)` – Basile Starynkevitch Oct 28 '14 at 12:44
  • @BasileStarynkevitch Thanks, just confirmed, it is ELF 64-bit LSB executable – http8086 Oct 28 '14 at 12:49
  • I'm seeing the same `-` for PID/Program name, but with State `TIME_WAIT`, when I run a bash script that uses `netcat` to do a port scan on my machine; but the process is owned by `root`; the port does eventually close within a couple minutes. I port scan the IP of my interface in my LAN, and that is what is showing as both Local and Foreign Address, both on the same ephemeral port; this struck me as possibly related. I didn't run `netcat` as root though; but I did run `netstat` as root. Not sure if this helps, but it's additional context. – Life5ign Aug 28 '22 at 20:50

1 Answers1

5

A dash "-" is given when the kernel itself is listening, consequently there are no associated processes to show. I am not sure which kernel thread is using tcp/10080 though.

Benjamin Goodacre
  • 347
  • 5
  • 15
  • 1
    `-` can also appear when socket is about to be closed in the near future (you will see `TIME_WAIT` in **State** column). But `-` is really strange in case of `LISTEN` state... – flaz14 May 14 '16 at 18:10
  • if it was kernel listening, there should not be user right? – http8086 May 23 '18 at 12:26
  • `file $(which netstat)` shows `/usr/bin/netstat: ELF 64-bit LSB shared object`. Calling `/usr/bin/netstat -Watnp | grep LISTEN` shows `172.16.13.93:7777 LISTEN -` so it's not `TIME_WAIT`. Any idea what could listen there? – andrej Jan 18 '21 at 14:19