Investigating processes on open ports

From: omer.akoz@turkcell.com.tr
Date: Tue Dec 12 2006 - 07:50:08 EST


Hello,

You can use this script :

#!/bin/ksh
#
# find from a port the pid that started the port # usage : port2pid.sh
<portnumber> #
line='------------------------------------------------------------------
-------'
pids=`/usr/bin/ps -ef | sed 1d | awk '{print $2}'`

# Prompt users or use 1st cmdline argument if [ $# -eq 0 ]; then
         read ans?"Enter port you like to know pid for: "
else
         ans=$1
fi

# Check all pids for this port, then list that process for f in $pids do
         /usr/proc/bin/pfiles $f 2>/dev/null | /usr/xpg4/bin/grep -q
"port: $ans"
         if [ $? -eq 0 ] ; then
                 echo "$line\nPort: $ans is being used by PID: \c"
                 /usr/bin/ps -o pid -o args -p $f | sed 1d
         fi
done
exit 0
-------------------------
-------------------------

Regards,
Omer.

-----Original Message-----
From: sunmanagers-bounces@sunmanagers.org
[mailto:sunmanagers-bounces@sunmanagers.org] On Behalf Of Mumdziev,
Marijan
Sent: Tuesday, December 12, 2006 1:58 PM
To: sunmanagers@sunmanagers.org
Subject: Investigating processes on open ports

Hello,

I was installing jboss 3.2.6. on Solaris 10 SPARC (Sun Netra 100). After
installation jboss could not start as some of the needed ports were
already opened. I tried to evaluate who uses the open ports with
following steps:

1) Jboss reports that he need three ports which are already in use:
1098, 4444, 8080.

2) I try to telnet to these ports and I see that really some process is
listening on these ports.

3) I am using netstat to gain some more information about listener on
specific ports: 8080, 4444, 1098. This is what I get:

bash# netstat -an|grep 8080
*.8080 *.* 0 0 49152 0 LISTEN
bash# netstat -an|grep 4444
*.4444 *.* 0 0 49152 0 LISTEN
bash# netstat -an|grep 1098
*.1098 *.* 0 0 49152 0 LISTEN

4) I am trying to find out a little bit more with command
/usr/local/bin/lsof -i :8080 (4444, 1098), but I do not get any output
for these ports.

5) Now I am checking configuration files under /etc and I am searching
for configuration file that contains string 4444 or 1098. I do not
execute the check for 8080 port, as in the meantime I have found out
that this port is used by Oracle-MTS.

I am using following command:
bash# find . -name '*' -a -type f -exec grep 1098 \{} \;

I do not get any output, meaning, no configuration file contains strings
which could lead me to some connection to our ports.

6) For the port 1098, I think it is used by sun cluster manager
rmiactivation, but I am not sure. Could be Oracle uses this port as
well.

Nevertheless, I did not get any information about the process which uses
these open ports. Eventually I got an impression that all three ports
are used by Oracle 10g.
How will I find out more information about which processes (PID) is
currently using these open ports?

Thank you very much for your prompt answer.
Best regards,

Marijan Mumdziev

P.S. "I need to get this machine working as soon as possible. Please
help! Send email and I will summarize to the list. :)"
_______________________________________________
sunmanagers mailing list
sunmanagers@sunmanagers.org
http://www.sunmanagers.org/mailman/listinfo/sunmanagers

************************************************************************
Bu elektronik posta ve onunla iletilen butun dosyalar sadece gondericisi
tarafindan almasi amaclanan yetkili gercek ya da tuzel kisinin kullanimi
icindir. Eger soz konusu yetkili alici degilseniz bu elektronik postanin
icerigini aciklamaniz, kopyalamaniz, yonlendirmeniz ve kullanmaniz kesinlikle
yasaktir ve bu elektronik postayi derhal silmeniz gerekmektedir.
TURKCELL bu mesajin icerdigi bilgilerin dogrulugu veya eksiksiz oldugu
konusunda herhangi bir garanti vermemektedir. Bu nedenle bu bilgilerin ne
sekilde olursa olsun iceriginden, iletilmesinden, alinmasindan ve
saklanmasindan sorumlu degildir. Bu mesajdaki gorusler yalnizca gonderen
kisiye aittir ve TURKCELLin goruslerini yansitmayabilir
Bu e-posta bilinen butun bilgisayar viruslerine karsi taranmistir.
************************************************************************
This e-mail and any files transmitted with it are confidential and intended
solely for the use of the individual or entity to whom they are addressed. If
you are not the intended recipient you are hereby notified that any
dissemination, forwarding, copying or use of any of the information is
strictly prohibited, and the e-mail should immediately be deleted.
TURKCELL makes no warranty as to the accuracy or completeness of any
information contained in this message and hereby excludes any liability of any
kind for the information contained therein or for the information
transmission, reception, storage or use of such in any way whatsoever. The
opinions expressed in this message belong to sender alone and may not
necessarily reflect the opinions of TURKCELL.
This e-mail has been scanned for all known computer viruses.
************************************************************************
_______________________________________________
sunmanagers mailing list
sunmanagers@sunmanagers.org
http://www.sunmanagers.org/mailman/listinfo/sunmanagers



This archive was generated by hypermail 2.1.7 : Wed Apr 09 2008 - 23:41:19 EDT