The PID and name of the program to which socket belongs

Question

Using 'netstat -tulp' on my server box running under CentOS I have discovered strange listening ports 33363 (TCP) and 35661 (UDP). The thing is that 'PID/Program name' field for these ports contains nothing (dash actually). 'fuser -n tcp 33363' shows nothing. I have checked my box with chkrootkit and rkhunter utilities and it seems everything is O.K. Does anybody know what these sockets can be used for?

Solution 1

Have you tried with lsof?

lsof -i TCP:33363
lsof -i UDP:35661

Solution 2

Did you run netstat -tulp as root?

Comments

[user14241]

Thanks for reply! Like 'fuser' 'lsof' gives an empty output.

[scetoaux]

Pretty weird... You can also try to trace the pid and see if it shows something interesting: strace -p <PID>

[innaM]

Could have been the reason for the missing pid. You never know ;-)

[innaM]

What PID, Fran?

[scetoaux]

Doh! True, we do not know the pid. Thanks for pointing it out Manni :)

[guettli]

Unfortunately lsof seems to usable only by root. My process is running as user "foo". I am user "foo", can get no results. Stragen. The tool nestat shows the open ports.