Update:
The port was opened by NFS. I figured this out by configuring NFS to listen on a known port.
Using Ubuntu 18.04
I want to know which process or kernel function listens on UDP port 38637.
I have researched this problem and found similar questions:
- https://superuser.com/questions/42843/finding-the-process-that-is-using-a-certain-port-in-linux
- https://unix.stackexchange.com/questions/106561/finding-the-pid-of-the-process-using-a-specific-port
- https://unix.stackexchange.com/questions/35292/quickly-find-which-files-belongs-to-a-specific-inode-number
- Network port open, but no process attached?
- netstat shows a listening port with no pid but lsof does not
- Permission denied on /proc/ some process
I have tried all remedies I could find...
- Unmounted all network drives
- Rebooted. After reboot the same port listens.
- Ran virus/trojan scans with clamav and sophos-av
nmap
andnc
both successfully connect on the port- Tried all the following inspections:
netstat
Shows no process ID
➜ sudo netstat -ulpen | grep 38637
udp 0 0 0.0.0.0:38637 0.0.0.0:* 0 36601 -
udp6 0 0 :::38637 :::* 0 36602 -
lsof
Shows nothing at all
➜ sudo lsof -i udp:38637
➜ echo $?
1
rpcinfo
Doesn't list the port of interest
➜ sudo rpcinfo -p | grep 38637
➜ echo $?
1
fuser
Troubling?
➜ sudo fuser -n udp 38637
Cannot stat file /proc/16147/fd/1023: Permission denied
Cannot stat file /proc/16374/fd/1023: Permission denied
Cannot stat file /proc/16375/fd/1023: Permission denied
Cannot stat file /proc/16380/fd/1023: Permission denied
Cannot stat file /proc/16381/fd/1023: Permission denied
Cannot stat file /proc/16382/fd/1023: Permission denied
Cannot stat file /proc/18061/fd/1023: Permission denied
Cannot stat file /proc/18177/fd/1023: Permission denied
Cannot stat file /proc/18183/fd/1023: Permission denied
Cannot stat file /proc/18188/fd/1023: Permission denied
Cannot stat file /proc/18189/fd/1023: Permission denied
Cannot stat file /proc/18190/fd/1023: Permission denied
inode doesn't give me anything either
➜ sudo fuser --inode 36601
Specified filename 36601 does not exist.
debugfs
Nada.
➜ sudo debugfs -R 'ncheck 36601' /dev/sda1
debugfs 1.44.1 (24-Mar-2018)
Inode Pathname
I would appreciate any other suggestions on where to look for answers on why this port listens.