Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am running software on a server that may be turning off some ports and need to find out what it is. I have the ports I need to check. I just need to find out what is turning them off. How can I do this?

share|improve this question
    
Software recommendations are off topic, and it may have been considered that is what you were after. I edited your question to ensure it's on topic for you, if you don't like it, roll it back :) – Dave Nov 1 '13 at 14:04
1  
scheduled scans with nessus would at least show you the changes, though it would provide little input as to why they had changed. I assume you've tried netstat -ntlup and lsof right? – Frank Thomas Nov 1 '13 at 14:10
    
What kind of server? Windows? Linux? Toaster? – Kevin Panko Nov 1 '13 at 16:26
up vote 1 down vote accepted

If you are using Windows, you can use Tcpview, a very convenient utility developed by Mark Russinovih before he became VP of Microsoft. It will refresh itself every 2 (??) seconds.

If you are on Linux, the command

 sudo ss -ntp

will show you all connected ports, except for those where your system is listening, which are instead displayed by the command

 sudo ss -lntp

Both commands show the process and Process ID which is using the port in question. If you wish to monitor your ports continuously, the command is

 sudo watch ss -ntp

and likewise for the other version: it will refresh itself every two seconds.

On Mac OS, you use

sudo lsof -n -i4TCP:$PORT | grep LISTEN

or some slight variant, depending on the exact version of your OS, as discussed here.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .