Let’s Use ‘netstat’ To Find Out What Process Is Listening On A Specific Port

Today’s article is going to teach you how to use ‘netstat’ to find out what process is listening on a specific port. If you have open ports and don’t know why – and what’s listening on that port, you’re not making good security choices.

Let’s say you followed an article about how to monitor TCP/UDP in real time. If you’re new, or even just not all that advanced with Linux and networking, you might not know why there are all those ports and all that activity. Well, one of the things you should know is how to identify what process is listening on a specific port.

There are a number of ways to do this, but we’ll be using ‘netstat’. The ‘netstat’ application can be pretty advanced, but what we’ll be doing is pretty straightforward. If you’re curious, ‘netstat’ defines itself thus:

Print network connections, routing tables, interface statistics, masquerade connections, and multicast memberships

As you can see, it’s a pretty advanced application. It has a rather expansive man page, and we’ll largely ignore that as we really only need some limited functionality. All we really need to do, for this exercise, is find out what process is listening on a specific port.

With that in mind, let’s leap into the meat of the article…

What Process Is Listening On A Specific Port:

This article requires an open terminal. If you don’t know how to open the terminal, you can do so with your keyboard – just press CTRL + ALT + T and your default terminal should open.

Once you have that open, you’ll need to find out if you have ‘netstat’ already installed. There are many ways to do this, I prefer:

If you do not have ‘netstat’ installed, it’s certainly available for all mainstream distros and easily installed from your default repositories. Here’s how to install on a few distros:

Debian/Ubuntu/Mint/etc:

RHEL/CentOS/Fedora/Rocky Linux/etc:

SUSE/OpenSUSE/etc:

If you’re using a different distro, root through the default repositories. It’s a pretty common tool and I’d like to imagine it’s easily available to anyone.

Once you have ‘netstat’ installed, the command we’re going to use is really, really, simple. In fact, I wrote this whole darned article mostly for just one command. I probably could have made it shorter. Still, it might as well be long enough to give some extra information along the way.

Anyhow, the command you run is this:

For example, you might have an open port 22 and want to know what process is listening on that specific port. So, you’re command would look like this:

The end result will look something like this:

netstat being used to find out which process is listening at a specific port
While not completely clear, you can deduce that it’s just the SSH daemon listening on port 22.

It may not be completely clear, but you can use this to deduce what process is listening on a specific port. If it’s not completely clear, you can get actually dig a little deeper. See the “1100” in there? Well, that’s the PID (Process ID) and you can use the following command to get more informtion. It looks like this:

The output from that in this case is:

Which, as we know, is the daemon for SSH and thus nothing unexpected is running on port 22. See? Security!

Closure:

And there you have it, another article. This one is a pretty handy one, especially for when you want to know what process is listening on a specific port. If you have things running that you can’t identify, you can always stop by Linux.org and ask for help. Someone there will try to find out what’s going on for you.

Thanks for reading! If you want to help, or if the site has helped you, you can donate, register to help, write an article, or buy inexpensive hosting to start your own site. If you scroll down, you can sign up for the newsletter, vote for the article, and comment.

Smash a button!
[Total: 3 Average: 5]

Monitor TCP/UDP In Real Time

If you’re concerned about network connections to your device, you may want to monitor TCP/UDP in real time. It’s a pretty handy way to get a handle on what connections are being made by your devices. This article could be pretty complicated, but I’ll try to make sense of it all.

By the way, if you ever want to be sure you know something, try explaining it to someone who knows nothing about it. It can be pretty humbling. Leave a comment letting me know how I did.

Anyhow, moving on…

Network connections happen on various ports. Think of them as though your computer is a country and you have various ports that let traffic in and let traffic out.

There are different kinds of traffic, just like there are different kinds of ships. You have leisure, goods, military ships, etc… You have cruise ships, tankers, cargo yachts, kayaks, aircraft carriers, etc. Traffic is often bidirectional, meaning going in and leaving on the same port. In the case of TCP and UDP, traffic is bidirectional so one port will accommodate both.

So…

What Are TCP and UDP Anyhow?

In the case of TCP, you may be familiar with the expression TCP/IP, and it stands for Transmission Control Protocol. TCP requires a server/client relationship and should only be used on certain ports. Those ports are things like FTP, SSH, SMTP, Time, TELNET, etc… So, if you know you don’t have an FTP server running, you really shouldn’t be seeing traffic on ports 20 or 21.

UDP, on the other hand, stands for “User Datagram Protocol”. Unlike UDP, there’s no client/server relationship required. It just spews traffic out as needed/ordered. UDP connections do things like check a DNS server to find the IP address for a domain name. It then waits for the server to respond. There’s less latency and it’s more useful for ‘real time’ processes. Voice and video may be sent using UDP. Again, if you’re seeing unrecognized traffic, there may be a problem.

If you want, you can get a general idea (you don’t really need to memorize this) of what belongs where, with regards of TCP/UDP traffic. Wikipedia has an excellent list of TCP/UDP port numbers.

So, with that information at hand, you can see why you might want to …

Monitor TCP/UDP In Real Time:

This article requires an open terminal, like many other articles on this site. If you don’t know how to open the terminal, you can do so with your keyboard – just press CTRL + ALT + T and your default terminal should open.

Once you have your terminal open, you can use ‘netstat’ and examine this in detail. If you just want to check once,  you can run this command:

To monitor it in real time, you’ll just use the ‘watch’ command. That’d look like this:

You can use the -n flag to change the refresh interval, as it will default to every two seconds. To make it every five seconds, the command would look like this:

You can change that number, but you can go no lower than once ever 0.1 seconds. I’m not sure if there’s an upper threshold, but it might have one. 

Either way, you can monitor your TCP/IP connections in real time. It’s not really all that difficult. You may see some results that alarm you, but odds are you’re just new to checking the output. Before getting alarmed and making drastic changes to your computer, research to see if the connection is actually just normal traffic.

Closure:

And there you have it, you have another article to read. This one is about how you can monitor TCP/UDP in real time, a useful tool if you’re concerned with your network’s traffic. Malicious activities will likely require network ingress and egress, so this can help your security assessments. Strange connections don’t necessarily mean there’s a problem – but they do mean you might want to look to see what’s causing the connections.

Thanks for reading! If you want to help, or if the site has helped you, you can donate, register to help, write an article, or buy inexpensive hosting to start your own site. If you scroll down, you can sign up for the newsletter, vote for the article, and comment.

Smash a button!
[Total: 5 Average: 4.6]
Linux Tips
Creative Commons License
This work is licensed under a Creative Commons Attribution 4.0 International License.
Zoom to top!