command to inentify the process that is listening in a port.

[Dan Nelson]

In the last episode (Apr 11), Bob Johnson said:
> On 4/10/07, Jonathan McKeown <jonathan at hst.org.za> wrote:
> >On Monday 09 April 2007 17:37, Martin Hudec wrote:
> >> Siju George wrote:
> >> > How Do you actually Identify what process is listening on a
> >> > TCP/IP port? "nmap" does not usually give the right answer.
> >> > There should be some command that can be run on the local host
> >> > for identification right?
> >>
> >> man lsof
> >>
> >> 5:35pm [amber] ~# lsof -i @localhost:123
> >> COMMAND PID USER   FD   TYPE     DEVICE SIZE/OFF NODE NAME
> >> ntpd    552 root   10u  IPv4 0xc4c46000      0t0  UDP localhost:ntp
> >
> >Just out of interest, why do so many people recommend lsof, which is
> >a port, when sockstat/fstat are in the base system and seem to cover
> >the same ground? Am I missing something about lsof?
> 
> Linux systems don't have sockstat, so people who got to FreeBSD via
> Linux are used to lsof and they tend to continue using it. Same
> result for those who read the many Linux howto websites.

lsof can also go into more detail about the open handles (can display
socket buffer sizes, for example), and has more filtering options.  It
also has a mode that generates easily machine-parsable output.  For
simple "what's listening on this port" questions, though, sockstat does
just fine.

-- 
	Dan Nelson
	dnelson at allantgroup.com