15

I'm testing an application which opens its own ports (acts as a server for these ports, hence listens at that ports) and where the same application connects to ports bound by other applications (acts as client for these ports).

I would like to get an overview as to which ports the application creates and to which applications and ports it connects to.

How can I do this?

0

5 Answers 5

21

You can use netstat for this. See the example (I grepped for ssh):

netstat -putan | grep ssh
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      1725/sshd
tcp        0      0 1.2.3.4:45734           1.2.3.5:22              ESTABLISHED 2491/ssh
tcp6       0      0 :::22                   :::*                    LISTEN      1725/sshd

Explanation:

I often use the parameters -putan (because they are simple to remember).

  • -p: show the PIDs of the application/process
  • -u: show udp ports/connections
  • -t: show tcp ports/connections
  • -a: show both listening and non-listening sockets
  • -n: numeric output (don't do DNS lookups for hostnames etc.)

In the output above, you see that there is an ssh daemon process (sshd) with PID 1725 listening at port 22 on all network interfaces (0.0.0.0). Also there is an ssh client process (PID 2491) connected to the IP-address 1.2.3.5 at port number 22, my IP-address is 1.2.3.4 and my external port is 45734. You see that the connection is established. Therefore I'm logged in via ssh.

5
  • An established TCP connection on port 22 does not indicate successful authentication. TCP must be established before authentication in either direction can occur.
    – jamesbtate
    May 6, 2015 at 17:56
  • @Puddingfox yes true, we could better say "I'm connected to that port", but for comprehension I said "i'm logged in", because it's more illustrative.
    – chaos
    May 6, 2015 at 18:11
  • 1
    hehe... `-putan' I'm so tempted to correct this minor spelling error ;) May 6, 2015 at 19:00
  • Why use obsolete utilities when modern ones are available? ss -lntp is the utility provided by the iproute2 suite. Jun 13, 2015 at 13:58
  • This post did not age well. lol Dec 6, 2023 at 23:55
7

Another tool that can do this is lsof:

# lsof -i -a -p 1981
COMMAND  PID USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
sshd    1981 root    3u  IPv4    917      0t0  TCP host.example.com:ssh (LISTEN)
# lsof -i -a -p 1981 -n
COMMAND  PID USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
sshd    1981 root    3u  IPv4    917      0t0  TCP 10.1.2.3:ssh (LISTEN)
# lsof -i -a -p 1981 -n -P
COMMAND  PID USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
sshd    1981 root    3u  IPv4    917      0t0  TCP 10.1.2.3:22 (LISTEN)
#

Options used are as follows:

  • -i to print out internet ports open by a process
  • -a to cause all options to be AND-ed
  • -p 1981 to show output for process 1981
  • -n to inhibit hostname lookup and show IP instead
  • -P to inhibit service lookup and show port number instead

lsof has the advantage that you can specify the process to check rather than having to grep it out of larger output. netstat is more reliably available on systems, although lsof is becoming more standard than it used to be.

2
  • I would like to run this command before launching the application I wish to monitor but can I establish what pid an application will get before starting it?
    – Baz
    May 8, 2015 at 6:56
  • @Baz, if you want to monitor an application as it starts up (e.g., before you know it's PID), you should try the strace solution that @olivecoder suggested.
    – gowenfawr
    May 11, 2015 at 3:22
4

We have already good answers but they only list the ports that are open at the moment the command runs.

strace is the right tool to monitor the connections opened during the application lifetime:

strace -e socket,connect,close -f -o hipchat.strace.txt hipchat

The output would show you additional information like UDP requests and opened but closed connections.

3

ss utility from iproute package for Linux

0

ss -a4 | less

I'm assuming you're speaking about IPv4... If not, you can replace the 4 in the preceeding command with 6. The -a parameter is to show all ports (listening and non). You can add -n to the parameters if you don't want to resolve names in the display.

Not the answer you're looking for? Browse other questions tagged .