Re: Who owns my unknown ports?

From: Ian Northeast (ian_at_house-from-hell.demon.co.uk)
Date: 12/06/03 

Date: Fri, 05 Dec 2003 23:50:54 +0000

Rohan Beckles wrote:
> Hello --
>
> I recently ran nmap against my system, and I've discovered a couple of ports
> of unknown origin. Is there a program that can tell me which processes own
> which TCP and UDP ports?

lsof -i :<port number>

In the unlikely event of your Linux system's not containing lsof,
ftp://vic.cc.purdue.edu/pub/tools/unix/lsof/.

Regards, Ian

Relevant Pages

  • Re: AW: Re: nmap -sS SYN-SCAN does not find all open Ports?
    ... Network Security Engineer and Analyst ... that there is actually no problem with nmap. ... ports that are not listed by nmap are in state closed. ... Could it somehow be related to my backend firewall? ...
    (Security-Basics)
  • Re: Nmap questions for the experts
    ... nmap has its own mailing lists, you can find those on insecure.org. ... Do you really use nmap before running nessus? ... Only open ports will be fed to ...
    (Security-Basics)
  • Re: nmap udp scan takes too long
    ... I am looking for a tool like nmap that would help me penetrate a filter port. ... But unicornscan beats nmap as it comes to udp scanning. ... Securing Apache Web Server with thawte Digital Certificate ... Open and filtered ports rarely send any kind ...
    (Security-Basics)
  • Re: UDP Scanning - how nmap really works
    ... > Seen as this method cannot be used, it does not seem feasible for nmap to generate any meaningful information in this ... > situation yet somehow it is differentiating between filtered and open udp ports. ... So how does it match PORT_FIREWALLED in UDP scanning? ... and still is marginally useful in internal networks with no filtering going on. ...
    (Pen-Test)
  • Re: Is my home computer at risk knowing that nmap says...
    ... Arizona) and saw that his firewall was DROPing connections to unused ... ports - including two ports that nmap scans by default. ... you responded to shows a reasonable response based on a minimal test ...
    (comp.os.linux.security)