Who is listning on my ports

Posted on 2007-01-13
Last updated on 2018-01-02
This is a mini tutorial in the usage of soctstat on FreeBSD, netstat on OpenBSD, and ss GNU/Linux.

sockstat can be used on FreeBSD in order to see which programs that are actively listning on one or several ports on the computer.

See man sockstat for further information.

In order to see, on FreeBSD, which programs that are actively listning now, and on which ports, you can type in the command:

# sockstat -l -4 -6

On openBSD you use the program netstat. See man netstat for further information.

# netstat -l -p

On a GNU/Linux distribution use ss. See man ss for further instructions.

# ss -a -t -p

On my FreeBSD 6.1 Security, where Sendmail is disabled, I get the following results:

USER COMMAND PID FD PROTO LOCAL ADDRESS FOREIGN ADDRESS
root cupsd 500 2 tcp6 ::1:631 *:*
root cupsd 500 3 tcp4 127.0.0.1:631 *:*
root cupsd 500 5 udp4 *:631 *:*
root syslogd 431 6 udp6 *:514 *:*
root syslogd 431 7 udp4 *:514 *:*

I can see two programs listning "syslogd" and "cupsd".

USER indicates who has started the program. System programs and several services are started by the system as root. COMMAND is the program or service name. PID is the process number assigned to the program or service and FD is the type of communication.

Below PROTO you can see which port the program or service is listning on. In this example "cupsd" is listning on port 631.

If you want to know what program or service that is running on a specific port you can use the followin command:

# sockstat -4 -6 -p NUMBER

In which NUMBER is the number of the port you want to investigate.