Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I've tried netstat and lsof with various options, but I'm getting garbage results. I'm interested to know the following data:

  • applications which binds the socket to port - port number

I would like to exclude UNIX sockets from this list, if possible, but this isn't very important.

To elaborate: by "garbage" I mean that neither netstat nor lsof print the port number... what I'm getting back looks something like:

rpc.statd   900 rpcuser    8u  IPv4   16330      0t0  UDP *:51038 

where I hoped for 51038 to be the port number, but it isn't, I cannot even figure out what that information is. Even worse, some times there would be letters instead of numbers, where I'd normally expect the port number - this is extremely unhelpful, because I'm trying to figure out what program occupies the port I'm trying to bind / connect to (I suspect those letters to be an alias to something, but, come on really... who needs that?)

share|improve this question
On all Linux systems I know, netstat -na ought to give you something to work on. Can Fedora be all that different? –  lserni Jul 6 '13 at 13:58
Please include the actual options you tried. Are you attempting to list info for all ports, or for one particular port? –  terdon Jul 6 '13 at 14:07
@lserni unfortunately not. This will not print the name of the program using (binding) the socket... –  wvxvw Jul 6 '13 at 14:09
@terdon oh, I've missed the -p option. Sorry, I've been trying them from memory instead of just reading through the list of options... well... I'm sorry :) netstat -npa did what I wanted. –  wvxvw Jul 6 '13 at 14:12
@wvxvw The port is correct, so I imagine your expectation of what should happen is not. Besides, nc by default is using tcp, whereas rpc.statd is listening on a udp port, so your command above will not work. –  Paul Jul 6 '13 at 14:38

3 Answers 3

up vote 1 down vote accepted

This is a netstat adaptation. You can replace "tcp\|udp" with "udp" or "tcp" alone:

netstat -nap \
    | grep "^\(tcp\|udp\)" \
    | grep -v "\.255:\|127\.0\.0\.1:" \
    | sort -n -k 4,6 \
    | sort -k 1 \
    | sed -e 's/LISTEN//g' \
    | tr -s " " "\t" | cut -f1,4,6- | column -t

It will output all TCP and UDP sockets. You can add another grep line before the sort

    | grep ":\*"

to only get listening sockets (on my distribution they are associated with ":*" as a port), and another line

    | grep -v ":::"

to not list IPv6 sockets.

The last line compresses the output and reexpands it in an optimal column format after removing columns 2, 3 and 5; remove it if you don't have column installed.

On my home dev system (OpenSuSE 12.3, not Fedora) the full script

netstat -nap \
        | grep "^\(tcp\|udp\)" \
        | grep -v "\.255:\|127\.0\.0\.1:" \
        | grep -v ":::" \
        | grep ":\*" \
        | sort -n -k 4,6 \
        | sort -k 1 \
        | sed -e 's/LISTEN//g' \
        | tr -s " " "\t" | cut -f1,4,6- | tr "[:/]" " " | column -t

returns (I also have an additional address-rewriting line) protocol, interface, port number, process ID, and command name.

tcp  ANY       111    649   rpcbind
tcp  ANY       1190   1848  xinetd
tcp  ANY       139    2364  smbd
tcp  ANY       21     1813  vsftpd
tcp  ANY       22     1855  sshd
tcp  ANY       25     3229  master
tcp  ANY       3306   2896  mysqld
tcp  ANY       3690   3053  svnserve
tcp  ANY       389    2293  slapd
tcp  ANY       445    2364  smbd
tcp  ANY       8200   2952  minidlna
tcp  ANY       902    2153  vmware-authd
tcp  INTERNAL  3128   2449  squid
tcp  INTERNAL  53     2386  named
udp  ANY       111    649   rpcbind
udp  ANY       123    2918  ntpd
udp  ANY       137    2177  nmbd
udp  ANY       138    2177  nmbd
udp  ANY       1900   2952  minidlna
udp  ANY       38408  2449  squid
udp  ANY       631    648   cupsd
udp  ANY       825    649   rpcbind
udp  EXTERNAL  123    2918  ntpd
udp  EXTERNAL  137    2177  nmbd
udp  EXTERNAL  138    2177  nmbd
udp  INTERNAL  123    2918  ntpd
udp  INTERNAL  137    2177  nmbd
udp  INTERNAL  138    2177  nmbd
udp  INTERNAL  53     2386  named
udp  INTERNAL  55440  2952  minidlna
share|improve this answer

nmap has always been one of the heavyweight port sniffers for both unix and windows. It's highly customisable and you can do all sorts of stuff with its output. An example localhost scan:

nmap -Pn localhost


Starting Nmap 6.25 ( http://nmap.org ) at 2013-07-22 01:48 BST
Nmap scan report for localhost (
Host is up (0.0023s latency).
rDNS record for localhost.localdomain
Not shown: 997 closed ports
22/tcp  open  ssh
25/tcp  open  smtp
631/tcp open  ipp

Get it from the yum repos: yum install nmap

share|improve this answer

Have you tried using sockstat? I don't know about Fedora, but I use sockstat on FreeBSD and Ubuntu to obtain the info you are looking for.

share|improve this answer
I actually did say it's Fedora 17. yum claims there's no sockstat that it knows of, but it's not uncommon for RHEL to rename things. If only I knew this is the case... :) –  wvxvw Jul 6 '13 at 14:39
I saw fedora in the subject and already edited the response –  BostonDriver Jul 6 '13 at 14:40

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.