How can I identify the command that spawned a process listening on a certain port?

Question

I’m using the following version of Linux

[davea@mydevbox ~]$ uname -a
Linux mydevbox.mydomain.com 5.7.8-35.36.amzn1.x86_64 #1 SMP Wed Mar 16 17:15:34 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux

I want to find out the command that started a process that listens on a particular port. Ideally, I’d like to find out from where that command is running. But I can’t seem to identify the command. Using nmap I can tell it is a Jetty server …

[davea@mydevbox ~]$ nmap -sV -p 4444 localhost

Starting Nmap 6.40 ( http://nmap.org ) at 2016-04-07 20:54 UTC
Nmap scan report for localhost (127.0.0.1)
Host is up (0.00020s latency).
PORT     STATE SERVICE VERSION
4444/tcp open  http    Jetty 5.1.x (Linux/4.4.5-15.26.amzn1.x86_64 amd64 java/1.7.0_79)

Service detection performed. Please report any incorrect results at http://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 6.25 seconds

Is there any way to figure out what command spawned the Jetty server?

Thanks, - Dave

Edit: Here is the output to the suggestion given.

[davea@mydevbox ~]$ sudo lsof -i :4444
COMMAND  PID USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
java    2140 root   10u  IPv6   9994      0t0  TCP *:krb524 (LISTEN)

[davea@mydevbox ~]$ sudo ps -p $(pidof java) -o args
ERROR: Process ID list syntax error.
********* simple selection *********  ********* selection by list *********
-A all processes                      -C by command name
-N negate selection                   -G by real group ID (supports names)
-a all w/ tty except session leaders  -U by real user ID (supports names)
-d all except session leaders         -g by session OR by effective group name
-e all processes                      -p by process ID
                                      -q by process ID (unsorted & quick)
T  all processes on this terminal     -s processes in the sessions given
a  all w/ tty, including other users  -t by tty
g  OBSOLETE -- DO NOT USE             -u by effective user ID (supports names)
r  only running processes             U  processes for specified users
x  processes w/o controlling ttys     t  by tty
*********** output format **********  *********** long options ***********
-o,o user-defined  -f full            --Group --User --pid --cols --ppid
-j,j job control   s  signal          --group --user --sid --rows --info
-O,O preloaded -o  v  virtual memory  --cumulative --format --deselect
-l,l long          u  user-oriented   --sort --tty --forest --version
-F   extra full    X  registers       --heading --no-heading --context
                                      --quick-pid
                    ********* misc options *********
-V,V  show version      L  list format codes  f  ASCII art forest
-m,m,-L,-T,H  threads   S  children in sum    -y change -l format
-M,Z  security data     c  true command name  -c scheduling class
-w,w  wide output       n  numeric WCHAN,UID  -H process hierarchy
[davea@mydevbox ~]$ 

Answer 1

lsof -i:4444

should list you the processes using 4444. You should start it as root or via sudo to avoid the output restricted to showing only the processes of your id.

Answer 2

There are many ways. A simple one involves ss:

# ss -lntp | grep 22
  LISTEN     0      128                       *:22                    *:*      users:(("sshd",1100,3))
  LISTEN     0      128                      :::22                   :::*      users:(("sshd",1100,4))

The options mean: -l display ports on which a process is listening, -n do not resolve names, -t consider only TCP ports, -p display the process listening on that port. In this case, you identify the process name (sshd, hardly surprising), and the process ID, 1100. For a UDP port, the above command should be morphed to ss -lnup.

Or you can use lsof:

# lsof -i :22
  COMMAND  PID USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
  sshd    1100 root    3u  IPv4  10089      0t0  TCP *:22 (LISEN)
  sshd    1100 root    4u  IPv6  10091      0t0  TCP *:22 (LISTEN

For a UDP port, the command should be lsof -i UDP:22.

Lastly, if you want to see the full command line which started a given process, you can do as follows:

# ps -p $(pidof sshd) -o args
  COMMAND
  /usr/sbin/sshd -D

In this case the whole command is not very informative, but occasionally it can be: do you know all the arguments in the invocation of your X server?

# ps -p $(pidof X) -o args
  COMMAND
  /usr/bin/X -core :0 -seat seat0 -auth /var/run/lightdm/root/:0 -nolisten tcp vt7 -novtswitch

If you want to learn more, like which chain of processes started the program in question, which may point to the user who started the program, use

ps auxf

which will show you, on the right hand side, the chain of forks leading to a currently running program, with much info as well.

Once you know the process id, PID, you can find all of the info available to the system in the directory /proc/PID, the tricky part being that the info is not immediately self-explanatory. Should you be interested, this article provides more info, otherwise use man proc.

Lastly, do remember that this info is not set in stone: programs can alter at least a part of their own info, see for instance this answer on ServerFault.