Re: Mapping of ports to processes

Randy Yates wrote:

I was trying to determine who had control of port 631 yesterday and
was unsuccessful.

It looks like netstat is the utility to use, but netstat -aeep doesn't
show anything connected to port 631. I would've thought that it's
cupsd that is handling that port but netstat shows cupsd on port 4660.

How do I find out who handles http://localhost:631 ?

if you have lsof you can try:

lsof -i :631

which would display any processes that are using this port.

Have a nice day
Rainer
--
---------------------------------------------------------------------------
Rainer Krienke, Universitaet Koblenz, Rechenzentrum, Raum A022
Universitaetsstrasse 1, 56070 Koblenz, Tel: +49 261287 -1312, Fax: -1001312
Mail: krienke@xxxxxxxxxxxxxx, Web: http://www.uni-koblenz.de/~krienke
Get my public PGP key: http://www.uni-koblenz.de/~krienke/mypgp.html
---------------------------------------------------------------------------
.

Relevant Pages

  • Re: Have I been compromised? chkrootkit: "Warning: Possible LKM Trojan installed" - nmap:
    ... assuming netstat wasn't one of the programs ... listed there for port 1313 correspond to the PIDs chkproc spit out. ... all your services while you upgrade all the software that needs upgrading. ... > Every week or so I'll run chkrootkit, mostly just because I feel I ...
    (comp.os.linux.security)
  • Re: AW: Program PORT ?
    ... > Or for nmap, that says what server is in each port: ... > PORT STATE SERVICE ... The original posters question can be answered using netstat or lsof. ...
    (Debian-User)
  • RE: I think Ive been hacked...please help!
    ... > connecting within seconds of boot. ... port scanning the machine from the outside ... experience performing incident response activities, ... one will run netstat and see something listening on ...
    (Incidents)
  • Summary: can we trace a listening udp/tcp ports to the underlying applications/program
    ... Linux will allow you to do this with a netstat -anp. ... You can install and use 'lsof'. ... 'lsof -i:3181' to find processes using that port. ... can we trace a listening udp/tcp ports to the underlying applications/program ...
    (SunManagers)
  • Re: Help, my machine has been hacked
    ... >> also take a look at processes running in your system, ... >> opened (netstat -tupan), environment changesetc. ... If you provide port 80 to the outside ... filter invalid packets, in particular tcp scans with invalid flags, where ...
    (comp.os.linux.security)