Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I am running software on a server that may be turning off some ports and need to find out what it is. I have the ports I need to check. I just need to find out what is turning them off. How can I do this?

share|improve this question
    
Software recommendations are off topic, and it may have been considered that is what you were after. I edited your question to ensure it's on topic for you, if you don't like it, roll it back :) –  Dave Nov 1 '13 at 14:04
1  
scheduled scans with nessus would at least show you the changes, though it would provide little input as to why they had changed. I assume you've tried netstat -ntlup and lsof right? –  Frank Thomas Nov 1 '13 at 14:10
    
What kind of server? Windows? Linux? Toaster? –  Kevin Panko Nov 1 '13 at 16:26

1 Answer 1

up vote 1 down vote accepted

If you are using Windows, you can use Tcpview, a very convenient utility developed by Mark Russinovih before he became VP of Microsoft. It will refresh itself every 2 (??) seconds.

If you are on Linux, the command

 sudo ss -ntp

will show you all connected ports, except for those where your system is listening, which are instead displayed by the command

 sudo ss -lntp

Both commands show the process and Process ID which is using the port in question. If you wish to monitor your ports continuously, the command is

 sudo watch ss -ntp

and likewise for the other version: it will refresh itself every two seconds.

On Mac OS, you use

sudo lsof -n -i4TCP:$PORT | grep LISTEN

or some slight variant, depending on the exact version of your OS, as discussed here.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.