Re: Mysterious process talking on 799=>2049 tcp - what is using the ports?

[Hanasaki JiJi <hanasaki@hanaden.com>]

netstat -tulpen   <= no output for grep 799 or 2049
	this was run as root

Hmmm are the PID0 bad? below

ps auxf | head
USER       PID %CPU %MEM   VSZ  RSS TTY      STAT START   TIME COMMAND
root         1  0.0  0.3  1460  416 ?        S    Aug31   0:05 init [2] 

root         2  0.0  0.0     0    0 ?        SW   Aug31   0:02 [keventd]
root         0  0.0  0.0     0    0 ?        SWN  Aug31   0:38
	[ksoftirqd_CPU0]
root         0  0.0  0.0     0    0 ?        SW   Aug31  18:30 [kswapd]
root         0  0.0  0.0     0    0 ?        SW   Aug31   0:00 [bdflush]
root         0  0.0  0.0     0    0 ?        SW   Aug31   2:54
	[kupdated]

Florian Ernst wrote:
> Hello Hanasaki!
>
> On Sat, Nov 08, 2003 at 10:16:34AM -0600, Hanasaki JiJi wrote:
>
> > How do i find out what is using those ports?
> >
> > netstat  -natl | grep 799
> > tcp        0      0	192.168.1.200:799
> > 			192.168.1.1:2049        ESTABLISHED
> >
> > below returns no output
> > 	lsof -i tcp:799
> > Nothing is using the port but it is in netstat????
>
>
> It is shown by netstat, but a normal user won't get further detail about
> it. root will:
>
> |fernst@live:~/mail$ lsof -i tcp:25
> |fernst@live:~/mail$ su
> |Password:
> |live:/home/fernst/mail# lsof -i tcp:25
> |COMMAND PID USER   FD   TYPE DEVICE SIZE NODE NAME
> |exim4   840 mail    0u  IPv4   1147       TCP localhost:smtp (LISTEN)
>
> "netstat -tulpen" might be even faster...
>
> Better setup sudo so you won't accidentally hose your system by staying
> root for too long... ;-)
>
> HTH,
> Flo