How to: Piece together Port and PID using Netstat, In Linux

Netstat

Linux and networking go hand in hand, whether running on the fancy desktop or noisy server. Regardless of which packages you choose to install, chances are, that they require networking for some functionality. A desktop may have some dns-cache, filtering proxy, anonymous socks or ssh-tunnel listening in the background. The server equally busy with its web, email, ftp, or nfs awaiting its clients. But when expected bandwidth is missing or something decides to communicate outside the expected standard, it can be difficult to guess which one of these ghosts and daemons is responsible.

Its good administrative practice to be aware of which protocols that are communicating over the wire, and who/what is allowed to do so. If open connections are not checked periodically, perhaps automatically. The system may have been subject to intrusion or be part of a massive botnet, where the activity goes unnoticed. Your system, Your sockets.

Netstat casts some light on the situation. Using the right switches, this utility can provide a detailed real-time overview of active connections. Among other things. One particular set of switches I find useful, found at cyberciti.biz (http://www.cyberciti.biz/faq/what-process-has-open-linux-port/) is as follows:

~$ netstat -tulpna (as root)

This nifty little line compress several features of netstat, and outputs almost everything you need to know.
Such as:

  • -t List TCP sockets
  • -u List UDP sockets
  • -l Display listening sockets
  • -p Display process ID related to socket
  • -n Skip domain name
  • -a Display all connected sockets

Sample Output (from cyberciti.biz)

Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 127.0.0.1:3306          0.0.0.0:*               LISTEN      1138/mysqld
tcp        0      0 0.0.0.0:111             0.0.0.0:*               LISTEN      850/portmap
tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN      1607/apache2
tcp        0      0 0.0.0.0:55091           0.0.0.0:*               LISTEN      910/rpc.statd
tcp        0      0 192.168.122.1:53        0.0.0.0:*               LISTEN      1467/dnsmasq
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      992/sshd
tcp        0      0 127.0.0.1:631           0.0.0.0:*               LISTEN      1565/cupsd
tcp        0      0 0.0.0.0:7000            0.0.0.0:*               LISTEN      3813/transmission
tcp6       0      0 :::22                   :::*                    LISTEN      992/sshd
tcp6       0      0 ::1:631                 :::*                    LISTEN      1565/cupsd
tcp6       0      0 :::7000                 :::*                    LISTEN      3813/transmission
udp        0      0 0.0.0.0:111             0.0.0.0:*                           850/portmap
udp        0      0 0.0.0.0:662             0.0.0.0:*                           910/rpc.statd
udp        0      0 192.168.122.1:53        0.0.0.0:*                           1467/dnsmasq
udp        0      0 0.0.0.0:67              0.0.0.0:*                           1467/dnsmasq
udp        0      0 0.0.0.0:68              0.0.0.0:*                           3697/dhclient
udp        0      0 0.0.0.0:7000            0.0.0.0:*                           3813/transmission
udp        0      0 0.0.0.0:54746           0.0.0.0:*                           910/rpc.statd

If you use netstat with the “-tulpna” switch regularly, put it in an bash alias. For example:
~$ alias tulpna=’netstat -tulpna’
Put it in .bashrc or .bash_aliases to make it permanent.

Happy hunting!

Be Sociable, Share!