0

I’m using the following version of Linux

[davea@mydevbox ~]$ uname -a
Linux mydevbox.mydomain.com 5.7.8-35.36.amzn1.x86_64 #1 SMP Wed Mar 16 17:15:34 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux

I want to find out the command that started a process that listens on a particular port. Ideally, I’d like to find out from where that command is running. But I can’t seem to identify the command. Using nmap I can tell it is a Jetty server …

[davea@mydevbox ~]$ nmap -sV -p 4444 localhost

Starting Nmap 6.40 ( http://nmap.org ) at 2016-04-07 20:54 UTC
Nmap scan report for localhost (127.0.0.1)
Host is up (0.00020s latency).
PORT     STATE SERVICE VERSION
4444/tcp open  http    Jetty 5.1.x (Linux/4.4.5-15.26.amzn1.x86_64 amd64 java/1.7.0_79)

Service detection performed. Please report any incorrect results at http://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 6.25 seconds

Is there any way to figure out what command spawned the Jetty server?

Thanks, - Dave

Edit: Here is the output to the suggestion given.

[davea@mydevbox ~]$ sudo lsof -i :4444
COMMAND  PID USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
java    2140 root   10u  IPv6   9994      0t0  TCP *:krb524 (LISTEN)

[davea@mydevbox ~]$ sudo ps -p $(pidof java) -o args
ERROR: Process ID list syntax error.
********* simple selection *********  ********* selection by list *********
-A all processes                      -C by command name
-N negate selection                   -G by real group ID (supports names)
-a all w/ tty except session leaders  -U by real user ID (supports names)
-d all except session leaders         -g by session OR by effective group name
-e all processes                      -p by process ID
                                      -q by process ID (unsorted & quick)
T  all processes on this terminal     -s processes in the sessions given
a  all w/ tty, including other users  -t by tty
g  OBSOLETE -- DO NOT USE             -u by effective user ID (supports names)
r  only running processes             U  processes for specified users
x  processes w/o controlling ttys     t  by tty
*********** output format **********  *********** long options ***********
-o,o user-defined  -f full            --Group --User --pid --cols --ppid
-j,j job control   s  signal          --group --user --sid --rows --info
-O,O preloaded -o  v  virtual memory  --cumulative --format --deselect
-l,l long          u  user-oriented   --sort --tty --forest --version
-F   extra full    X  registers       --heading --no-heading --context
                                      --quick-pid
                    ********* misc options *********
-V,V  show version      L  list format codes  f  ASCII art forest
-m,m,-L,-T,H  threads   S  children in sum    -y change -l format
-M,Z  security data     c  true command name  -c scheduling class
-w,w  wide output       n  numeric WCHAN,UID  -H process hierarchy
[davea@mydevbox ~]$ 

2 Answers 2

0

lsof -i:4444

should list you the processes using 4444. You should start it as root or via sudo to avoid the output restricted to showing only the processes of your id.

2
  • True this lists the processes, but not the full command line of what started the process listening on that port. In an edit to my question, you can see I ran this command but it just says "java". I'm tryihng to figure out what command kicked off this Java process.
    – Dave
    Apr 8, 2016 at 13:46
  • ps -f $THATPID will tell you about the parent process id (PPID)
    – user556625
    Apr 8, 2016 at 13:59
3

There are many ways. A simple one involves ss:

# ss -lntp | grep 22
  LISTEN     0      128                       *:22                    *:*      users:(("sshd",1100,3))
  LISTEN     0      128                      :::22                   :::*      users:(("sshd",1100,4))

The options mean: -l display ports on which a process is listening, -n do not resolve names, -t consider only TCP ports, -p display the process listening on that port. In this case, you identify the process name (sshd, hardly surprising), and the process ID, 1100. For a UDP port, the above command should be morphed to ss -lnup.

Or you can use lsof:

# lsof -i :22
  COMMAND  PID USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
  sshd    1100 root    3u  IPv4  10089      0t0  TCP *:22 (LISEN)
  sshd    1100 root    4u  IPv6  10091      0t0  TCP *:22 (LISTEN

For a UDP port, the command should be lsof -i UDP:22.

Lastly, if you want to see the full command line which started a given process, you can do as follows:

# ps -p $(pidof sshd) -o args
  COMMAND
  /usr/sbin/sshd -D

In this case the whole command is not very informative, but occasionally it can be: do you know all the arguments in the invocation of your X server?

# ps -p $(pidof X) -o args
  COMMAND
  /usr/bin/X -core :0 -seat seat0 -auth /var/run/lightdm/root/:0 -nolisten tcp vt7 -novtswitch

If you want to learn more, like which chain of processes started the program in question, which may point to the user who started the program, use

ps auxf

which will show you, on the right hand side, the chain of forks leading to a currently running program, with much info as well.

Once you know the process id, PID, you can find all of the info available to the system in the directory /proc/PID, the tricky part being that the info is not immediately self-explanatory. Should you be interested, this article provides more info, otherwise use man proc.

Lastly, do remember that this info is not set in stone: programs can alter at least a part of their own info, see for instance this answer on ServerFault.

4
  • Yes, the full commandn line is what I want to see, so it looks like the "ps" command you listed would do the job. However, when I run it, I get a syntax error using what you have. The error is included as an edit to my question.
    – Dave
    Apr 8, 2016 at 13:45
  • @Dave It is strange it does not work, it works perfectly on my system: did you try the command directly using the process PID, instead of $(pidof java)? Also, you should try the other solution I suggested, i.e., reading the file /proc/PID/cmdline. Apr 8, 2016 at 19:25
  • I've fallen in love with ss at first sight. Strange that I've not seen it (or don't remember) referred before.
    – user556625
    Apr 8, 2016 at 20:42
  • @GombaiSándor It can do more than lsof. Apr 9, 2016 at 7:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .