Mapping Ports and PIDs

By  

There are many reasons why you might need to determine what process is using a particular port or, conversely, what port(s) a particular process has open. There are also a number of tools such as lsof (list open files) and pfiles that can provide this information to you in various formats.

You can, for example, use the pfiles command to find out that process 27727 (an Apache process) has port 80 open:

# pfiles 27727 | grep -i port
        sockname: AF_INET 0.0.0.0  port: 80

If you don't use grep to pare down your display to just the open ports, you will see information on open files as well as ports and would then have to locate the port in the output.

You can view the same output for all snmpd processes like this:

# pfiles `pgrep snmpd` | grep port:
        sockname: AF_INET 0.0.0.0  port: 16161
        sockname: AF_INET 0.0.0.0  port: 32808
        sockname: AF_INET 0.0.0.0  port: 32809
        sockname: AF_INET 0.0.0.0  port: 161
        sockname: AF_INET 0.0.0.0  port: 32817
        sockname: AF_INET 0.0.0.0  port: 32873
	...

It gets a little trickier if you want a nice clean listing showing each PID along with its ports. Here's an example:

# for P in `pgrep snmpd`
> do
>     pfiles $P | egrep "$P|port:"
> done
10084:  /usr/lib/snmp/snmpdx -y -c /etc/snmp/conf
        sockname: AF_INET 0.0.0.0  port: 16161
        sockname: AF_INET 0.0.0.0  port: 32808
        sockname: AF_INET 0.0.0.0  port: 32809
10137:  /usr/sfw/sbin/snmpd
        sockname: AF_INET 0.0.0.0  port: 161
        sockname: AF_INET 0.0.0.0  port: 32817
        sockname: AF_INET 0.0.0.0  port: 32873
	...

Note that, in the commands above, I specified "port:" rather than simply "port" to avoid including in the display files (such as /export/home/jdoe/myfile) that happen to have the word "port" in their paths.

An even easier and more generalizable way to extract process/port mappings from your system is to make use of a Korn script named "pcp" (for "PID con Port").

The pcp script uses pfiles and other "proc" commands such a ptree to provide PID and port information in a tidy display. In fact, you can ask the script to supply ports associated with a process by using the -P option and specifying the PID or you can ask the script to supply PIDs responsible for certain open ports by using the -p option and specifying the port. Got that? Uppercase P for PID and lowercase p for port.

Let's look at some examples.

Here, we ask to see the port(s) that process 27727 has open:

# ./pcp -P 27727
PID     Process Name and Port
_________________________________________________________
27727   /usr/apache/bin/httpd
        sockname: AF_INET 0.0.0.0  port: 80
_________________________________________________________

Next, we ask to see all the processes that are using port 80:

# ./pcp -p 80
PID     Process Name and Port
_________________________________________________________
10132   /usr/apache/bin/httpd   80
        sockname: AF_INET 0.0.0.0  port: 80
_________________________________________________________
10156   /usr/apache/bin/httpd   80
        sockname: AF_INET 0.0.0.0  port: 80
_________________________________________________________
10157   /usr/apache/bin/httpd   80
        sockname: AF_INET 0.0.0.0  port: 80
...
...
_________________________________________________________
27727   /usr/apache/bin/httpd   80
        sockname: AF_INET 0.0.0.0  port: 80
_________________________________________________________

If you would like a table of all processes (all processes with open ports anyway) and their corresponding ports, you would run pcp with the -a (all) option.

You can download from pcp from:

http://www.unix.ms/pcp/
Join us:
Facebook

Twitter

Pinterest

Tumblr

LinkedIn

Google+

IT ManagementWhite Papers & Webcasts

See more White Papers | Webcasts

Answers - Powered by ITworld

ITworld Answers helps you solve problems and share expertise. Ask a question or take a crack at answering the new questions below.

Ask a Question
randomness