12

I'm getting crazy with the command netstat.
In the man we can read that, in the output of Active Internet Connections (TCP, UDP, raw) we should have :

User : The username or the user id (UID) of the owner of the socket.

But when I do

netstat -natp

my output doesn't show any owner (or UID)

Active Internet connections (servers and established)  
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name  
tcp        0      0 0.0.0.0:4713            0.0.0.0:*               LISTEN      2159/pulseaudio  
(...)

and I don't see any option in the man to display the owner of the PID.

There is the --numeric-users option, but it doesn't change anything.

Is there something I'm missing? Or there is something wrong with netstat ?
Is there another way to get this information?

Thanks for your help :)

2 Answers 2

20

Use netstat -natpe.

From the man page:

-e, --extend
 Display additional information.  Use this option twice for maximum detail.

As clear as mud.

Which will add two columns, User and Inode to the display.

Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address               Foreign Address             State       User       Inode      PID/Program name
tcp        0      0 0.0.0.0:3306                0.0.0.0:*                   LISTEN      100        13119      1901/mysqld
2
  • Thank you very much yoonix. I've completely skipped this option as I was focused on searching for "user" and "owner" terms XD. I'll vote up for you as soon as I have a reputation of 15 ^^
    – Matt C
    Feb 21, 2014 at 20:48
  • 1
    Just thought it'd be worth noting that in case you can't figure who's who (like 0 is root) try peeking /etc/passwd in read mode ;)
    – RickB
    Feb 4, 2018 at 16:46
6

Alternatively, you could use lsof -i which shows you the user.

COMMAND     PID    USER   FD   TYPE  DEVICE SIZE/OFF NODE NAME
httpd     32500  apache    4u  IPv6   14390      0t0  TCP *:http (LISTEN)
httpd     32501  apache    4u  IPv6   14390      0t0  TCP *:http (LISTEN)
httpd     32502  apache    4u  IPv6   14390      0t0  TCP *:http (LISTEN)
httpd     32503  apache    4u  IPv6   14390      0t0  TCP *:http (LISTEN)
0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .