3

I know how to do the opposite (find out what process has a given port open) using lsof or netstat, but extensive research on Google hasn't helped me solve the reverse problem.

I know I could use "netstat -np" combined with some grep and sed, but it seems hacky. Is there a reversed version of "lsof -i tcp:80" that will show me all the local ports opened by a given process?

Alex G
  • 376
  • 1
  • 4
  • 13

2 Answers2

11

Take a look at the man page, you'll find that you can use the -p option to specify a process id, and the -i option to limit the display to internet domain sockets (-i4 for just ipv4 and -i6 for just ipv6). So if you string them together...

lsof -p <pid> -i

...you get not quite what you want, because by default lsof will or together your requests. So add the -a (and) flag...

lsof -p <pid> -a -i

...and you'll get a list of the IPv4 sockets open by the specified process id.

larsks
  • 41,276
  • 13
  • 117
  • 170
  • And if you only care about the TCP ports the process is LISTENing to replace `-i` with `-iTCP -sTCP:LISTEN` – ndemou Jun 02 '15 at 19:02
1

I know I could use netstat -np combined with some grep and sed, but it seems hacky.

How about this:

# netstat --inet -nlp | grep <processname>

Is there a reversed version of lsof -i tcp:80 that will show me all the local ports opened by a given process?

# lsof -c <processname> | grep LISTEN
quanta
  • 50,327
  • 19
  • 152
  • 213