Unix as a Second Language

Mapping Ports and PIDs

There are many reasons why you might need to determine what process is using a particular port or, conversely, what port(s) a particular process has open. There are also a number of tools such as lsof (list open files) and pfiles that can provide this information to you in various formats.

You can, for example, use the pfiles command to find out that process 27727 (an Apache process) has port 80 open:

# pfiles 27727 | grep -i port
        sockname: AF_INET 0.0.0.0  port: 80

If you don't use grep to pare down your display to just the open ports, you will see information on open files as well as ports and would then have to locate the port in the output.

You can view the same output for all snmpd processes like this:

# pfiles `pgrep snmpd` | grep port:
        sockname: AF_INET 0.0.0.0  port: 16161
        sockname: AF_INET 0.0.0.0  port: 32808
        sockname: AF_INET 0.0.0.0  port: 32809
        sockname: AF_INET 0.0.0.0  port: 161
        sockname: AF_INET 0.0.0.0  port: 32817
        sockname: AF_INET 0.0.0.0  port: 32873
	...

It gets a little trickier if you want a nice clean listing showing each PID along with its ports. Here's an example:

# for P in `pgrep snmpd`
> do
>     pfiles $P | egrep "$P|port:"
> done
10084:  /usr/lib/snmp/snmpdx -y -c /etc/snmp/conf
        sockname: AF_INET 0.0.0.0  port: 16161
        sockname: AF_INET 0.0.0.0  port: 32808
        sockname: AF_INET 0.0.0.0  port: 32809
10137:  /usr/sfw/sbin/snmpd
        sockname: AF_INET 0.0.0.0  port: 161
        sockname: AF_INET 0.0.0.0  port: 32817
        sockname: AF_INET 0.0.0.0  port: 32873
	...

Note that, in the commands above, I specified "port:" rather than simply "port" to avoid including in the display files (such as /export/home/jdoe/myfile) that happen to have the word "port" in their paths.

An even easier and more generalizable way to extract process/port mappings from your system is to make use of a Korn script named "pcp" (for "PID con Port").

The pcp script uses pfiles and other "proc" commands such a ptree to provide PID and port information in a tidy display. In fact, you can ask the script to supply ports associated with a process by using the -P option and specifying the PID or you can ask the script to supply PIDs responsible for certain open ports by using the -p option and specifying the port. Got that?

Sign up for ITworld's Daily newsletter
Follow ITworld on Twitter @IT_world