Ali Jawad's Portal Site

Hey All

This are just some tips and tricks about ports and processes in linux, I might turn this into a FAQ once I have enough entries

This is about how to know which process is using what port in linux.

Well it is quite easy, suppose you want to know what process is using port 80 all you have to do is the following :

#netstat -apn | grep 22 

This should output something like:

tcp6       0      0 :::22                   :::*                    LISTEN     2818/sshd

As you can see the PID "process id" number is 2818, and the process is called sshd, I.e. the ssh server. Suppose the process was not named you could get the name by taking the PID and executing

ps aux |  grep  2818 | grep -v grep
root      2818  0.0  0.1   4932   820 ?        Ss   Apr02   0:01 /usr/sbin/sshd

As you can see this resulted in the path of the binary being executed and it's name.

Another method to get the process using a port is through using lsof, you can install it on debian using apt-get install lsof

An example would be:

debian:~# lsof -i tcp:22
COMMAND   PID USER   FD   TYPE   DEVICE SIZE NODE NAME
sshd     2818 root    3u  IPv6     6583       TCP *:ssh (LISTEN)

To check which process is taking most of your bandwidth use the jnettop command, it can be install using apt-get install jnettop, I know there are alot of other tools around such as iptraf iptop and others but I like using jnettop, it summarizes what I need to know and it is simple to use. Apart from that it allows you to monitor the bandwidth usage of your network users if it is used on a Linux router

#jnettop -i eth0

run   0:00:01 device eth0       pkt[f]ilter: none                              .
[c]ntfilter: on  [b]ps=bytes/s [l]ocal aggr: none      [r]emote aggr: none
[q]uit [h]elp [s]orting [p]ackets [.] pause [0]-[9] switch device
LOCAL <-> REMOTE                                          TXBPS   RXBPS TOTALBPS
 (IP)              PORT  PROTO  (IP)              PORT       TX      RX    TOTAL
od-in-f112.google.com <-> 192.168.0.168                 4.03k/s 1.75k/s  5.78k/s
 64.233.161.112     443    TCP  192.168.0.168     2179    11.0k   6.88k    17.8k

od-in-f112.google.com <-> 192.168.0.168                  895b/s 1.64k/s  2.52k/s
 64.233.161.112     443    TCP  192.168.0.168     2183    3.35k   6.60k     9.9k

a72-247-238-218.deploy.akamaitechnologies.com <-> 192.1 1.27k/s   90b/s  1.36k/s
 72.247.238.218      80    TCP  192.168.0.168     2191    2.55k    180b    2.73k

a72-247-242-83.deploy.akamaitechnologies.com <-> 192.16  935b/s   60b/s   995b/s
 72.247.242.83       80    TCP  192.168.0.152     3129    1.83k    120b    1.94k

a72-247-242-83.deploy.akamaitechnologies.com <-> 192.16  623b/s  354b/s   977b/s
 72.247.242.83       80    TCP  192.168.0.152     3131    1.22k    708b    1.91k
  GET /rsrc.php/91449/js/search.js

────────────────────────────────────────────────────────────────────────────────
TOTAL                                                   9.14k/s 4.65k/s  13.8k/s
                                                          45.6k   39.7k    85.3k

I do use postfix as my MTA if you ever had problems with your mail queue you have post most propably either used mailq or postqueue to check and manipulate the mailq and delete frozen emails among other tasks. If you want a tool that is easier to use and ncurses based check out this program  called  pfqeue
 

Only registered users can write comments.
Please login or register.

Powered by AkoComment 2.0!