################### # netstat - Basic # ################### See: https://www.cyberciti.biz/faq/what-process-has-open-linux-port/ Type the following command: -------------------------- netstat -tulpn Sample outputs: -------------- Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name tcp 0 0 127.0.0.1:3306 0.0.0.0:* LISTEN 1138/mysqld tcp 0 0 0.0.0.0:111 0.0.0.0:* LISTEN 850/portmap tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN 1607/apache2 tcp 0 0 0.0.0.0:55091 0.0.0.0:* LISTEN 910/rpc.statd tcp 0 0 192.168.122.1:53 0.0.0.0:* LISTEN 1467/dnsmasq tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 992/sshd tcp 0 0 127.0.0.1:631 0.0.0.0:* LISTEN 1565/cupsd tcp 0 0 0.0.0.0:7000 0.0.0.0:* LISTEN 3813/transmission tcp6 0 0 :::22 :::* LISTEN 992/sshd tcp6 0 0 ::1:631 :::* LISTEN 1565/cupsd tcp6 0 0 :::7000 :::* LISTEN 3813/transmission udp 0 0 0.0.0.0:111 0.0.0.0:* 850/portmap udp 0 0 0.0.0.0:662 0.0.0.0:* 910/rpc.statd udp 0 0 192.168.122.1:53 0.0.0.0:* 1467/dnsmasq udp 0 0 0.0.0.0:67 0.0.0.0:* 1467/dnsmasq udp 0 0 0.0.0.0:68 0.0.0.0:* 3697/dhclient udp 0 0 0.0.0.0:7000 0.0.0.0:* 3813/transmission udp 0 0 0.0.0.0:54746 0.0.0.0:* 910/rpc.statd TCP port 3306 was opened by mysqld process having PID # 1138. You can verify this using /proc, enter: ls -l /proc/1138/exe Sample outputs: -------------- lrwxrwxrwx 1 root root 0 2010-10-29 10:20 /proc/1138/exe -> /usr/sbin/mysqld You can use grep command to filter out information: -------------------------------------------------- netstat -tulpn | grep :80 Sample outputs: -------------- tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN 1607/apache2 1. List all ports listening and non-listening: ------------------------------------------ netstat -a | more 2. List all TCP ports: ------------------ netstat -at | more 3. List all UDP ports: ------------------ netstat -au | more 4. List sockets which are in listening state: ----------------------------------------- netstat -l | more netstat -lt | more #TCP ports netstat -lu | more #UDP ports 5. Show the statistics for each protocol: ------------------------------------- netstat -s netstat -st #TCP ports netstat -su #UDP ports 6. Display PID and program names in netstat output: ----------------------------------------------- netstat -lp | more netstat -ltp | more #TCP ports netstat -lup | more #UDP ports 7. Print netstat information continuously: -------------------------------------- netstat -c netstat -ct #TCP ports netstat -cu #UDP ports 8. Find non supportive address families in your system: --------------------------------------------------- netstat --verbose 9. Display kernel routing information: ---------------------------------- netstat -r 10. Find out on which port a program is running: ------------------------------------------- netstat -ap | grep SSH netstat -an | grep ":80" 11. Show the list of network interfaces: ----------------------------------- netstat -i netstat -ie 12. Listing all UNIX listening ports: -------------------------------- netstat -lx 13. Displaying promiscuous mode: --------------------------- netstat -ac 5 | grep tcp 14. Displaying IPv4 and IPv6 information: ------------------------------------ netstat -g 15. Displaying RAW network statistics: --------------------------------- netstat --statistics --raw