Writer : http://www.ischo.net -- ischo // System Engineer

+++++++++++++++++++++++++++++++++++++++++++++++++++++++

How to identify process ID which opened specific TCP port without install lsof 

1. Listing Listening port number.  ex) Show socket listening TCP 21 port.

[root :/]# netstat -anA | grep LISTEN
f1000d0001bed390 tcp        0      0  *.21               *.*                LISTEN
f1000d00002e3390 tcp4       0      0  *.22               *.*                LISTEN
f1000d0002a7ab90 tcp4       0      0  *.80               *.*                LISTEN
f1000d0000458390 tcp4       0      0  *.111              *.*                LISTEN
f1000d0002776390 tcp4       0      0  *.443              *.*                LISTEN

f1000d0001bed390 is socket address which listening TCP 21 port.

2. Retriving ProcessID from socket address.
[root :/]# rmsock f1000d0001bed390 tcpcb
The socket 0x1bed000 is being held by proccess 626780 (inetd).

rmsock command is used to remove socket.

If you try to delete the socket address that the process is holding, Show PID with message "The socket is being held by process"

Socket And the socket will not be terminated.

3. Identifying Process

[root :/]# ps -ef | grep 626780
    root  626780       1   0  9¿ù 28ÀÏ      -  0:00 /usr/sbin/inetd -d

Now we found the process.