May 06, 2009, 12:56 PM — There are many reasons why you might need to determine what process is using a particular port or, conversely, what port(s) a particular process has open. There are also a number of tools such as lsof (list open files) and pfiles that can provide this information to you in various formats.
You can, for example, use the pfiles command to find out that process 27727 (an Apache process) has port 80 open:
# pfiles 27727 | grep -i port
sockname: AF_INET 0.0.0.0 port: 80
If you don't use grep to pare down your display to just the open ports, you will see information on open files as well as ports and would then have to locate the port in the output.
You can view the same output for all snmpd processes like this:
# pfiles `pgrep snmpd` | grep port:
sockname: AF_INET 0.0.0.0 port: 16161
sockname: AF_INET 0.0.0.0 port: 32808
sockname: AF_INET 0.0.0.0 port: 32809
sockname: AF_INET 0.0.0.0 port: 161
sockname: AF_INET 0.0.0.0 port: 32817
sockname: AF_INET 0.0.0.0 port: 32873
...
It gets a little trickier if you want a nice clean listing showing each PID along with its ports. Here's an example:
# for P in `pgrep snmpd`
> do
> pfiles $P | egrep "$P|port:"
> done
10084: /usr/lib/snmp/snmpdx -y -c /etc/snmp/conf
sockname: AF_INET 0.0.0.0 port: 16161
sockname: AF_INET 0.0.0.0 port: 32808
sockname: AF_INET 0.0.0.0 port: 32809
10137: /usr/sfw/sbin/snmpd
sockname: AF_INET 0.0.0.0 port: 161
sockname: AF_INET 0.0.0.0 port: 32817
sockname: AF_INET 0.0.0.0 port: 32873
...
Note that, in the commands above, I specified "port:" rather than simply "port" to avoid including in the display files (such as /export/home/jdoe/myfile) that happen to have the word "port" in their paths.
An even easier and more generalizable way to extract process/port mappings from your system is to make use of a Korn script named "pcp" (for "PID con Port").
The pcp script uses pfiles and other "proc" commands such a ptree to provide PID and port information in a tidy display. In fact, you can ask the script to supply ports associated with a process by using the -P option and specifying the PID or you can ask the script to supply PIDs responsible for certain open ports by using the -p option and specifying the port. Got that? Uppercase P for PID and lowercase p for port.
Let's look at some examples.
Here, we ask to see the port(s) that process 27727 has open:
# ./pcp -P 27727
PID Process Name and Port
_________________________________________________________
27727 /usr/apache/bin/httpd
sockname: AF_INET 0.0.0.0 port: 80
_________________________________________________________
Next, we ask to see all the processes that are using port 80:
# ./pcp -p 80
PID Process Name and Port
_________________________________________________________
10132 /usr/apache/bin/httpd 80
sockname: AF_INET 0.0.0.0 port: 80
_________________________________________________________
10156 /usr/apache/bin/httpd 80
sockname: AF_INET 0.0.0.0 port: 80
_________________________________________________________
10157 /usr/apache/bin/httpd 80
sockname: AF_INET 0.0.0.0 port: 80
...
...
_________________________________________________________
27727 /usr/apache/bin/httpd 80
sockname: AF_INET 0.0.0.0 port: 80
_________________________________________________________
If you would like a table of all processes (all processes with open ports anyway) and their corresponding ports, you would run pcp with the -a (all) option.
You can download from pcp from:
http://www.unix.ms/pcp/
