Most of the time we are in situation to find the process which is holding the same port which may cause the application issues. This post will help us whenever we are in same position. Yes, we can find the process with using port in different methods. Let we start to search it.....
root@solaris-1# ndd /dev/tcp tcp_listen_hash
TCP zone IP addr port seqnum backlog (q0/q/max)
----skipped------
281 ffffffff81d46440 0 ::ffff:127.0.0.1 00025 00000000 0/0/16
----skipped------
From the above output we can find the process of the port 25, please follow the below steps
root@solaris-1# mdb -k
Loading modules:[unix krtld genunix specfs dtrace cpu.generic uppc pcplusmp ufs md mpt ip hook neti sctp arp usba fctl nca lofs audiosup cpc fcip random crypto zfs logindmux ptm sppp sata nfs]
>
> ffffffff81d46440::print tcp_t tcp_rq
tcp_rq = 0xffffffff8961f028
>
> 0xffffffff8961f028::q2stream
ffffffff87052e10
>
> ffffffff87052e10$ 0xffffffff874bc780::whereopen
file ffffffff893689d8
ffffffff88dc8900
>
> ffffffff88dc8900::ps
S PID PPID PGID SID UID FLAGS ADDR NAME
R 935 1 935 935 0 0x52010000 ffffffff88dc8900 sendmail
>
root@solaris-1#
Yes!!! We have found the process (sendmail) which using the port 25
We can use lsof utility to find the process with using port. Although lsof will not be available on all Solaris server, we have to install the lsof package. NOTE: This utility can't be used in Non-global zones.
root@solaris-1# /usr/local/bin/lsof -i :25
lsof: WARNING: access /.lsof_solaris-1: No such file or directory
lsof: WARNING: created device cache file: /.lsof_solaris-1
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
sendmail 935 root 5u IPv4 0xffffffff81d46240 0t0 TCP localhost:smtp (LISTEN)
root@solaris-1#
Yes, we have found the process with using port by using lsof utility.
Now our concern would be how to check the process with using port in non-global zone level. Yes, we have the option to do that by using our customized script. Please follow the steps...
root@solaris-1# cat /var/tmp/check_port.sh
#!/bin/ksh
CODE='---------------------------------------------'
PID=$(/usr/bin/ps -ef | sed 1d | awk '{print $2}')
if [ $# -eq 0 ]; then
read PORT?"Enter port you would like to know pid for: "
else
PORT=$1
fi
for f in $PID
do
/usr/proc/bin/pfiles $f 2>/dev/null | /usr/xpg4/bin/grep -q "port: $PORT"
if [ $? -eq 0 ]; then
echo $CODE
echo "Port: $PORT is being used by PID:\c"
/usr/bin/ps -ef -o pid -o args | egrep -v "grep|pfiles" | grep $f
fi
done
exit 0
root@solaris-1#
Copy the script and executed as mentioned below
root@solaris-1# /var/tmp/check_port.sh
Enter port you would like to know pid for: 25
---------------------------------------------
Port: 25 is being used by PID: 935 /usr/lib/sendmail -bl -q15m
root@solaris-1#
Yes... We have found the process with using the port by executing customized scripts.
With netstat enhancements in Solaris 11.2 release onwards new flag "-u" has been added, which would list USER, PID and program name of the process and network port details.
$ netstat -un -P tcp
TCP: IPv4
Local Address Remote Address User Pid Command Swind Send-Q Rwind Recv-Q State
-------------------- -------------------- -------- ------ ------------- ------- ------ ------- ------ -----------
127.0.0.1.59101 127.0.0.1.5011 root 6364 telnet 130880 0 139264 0 ESTABLISHED
127.0.0.1.5011 127.0.0.1.59101 root 4884 vntsd 139060 0 130880 0 ESTABLISHED
192.168.11.2.46829 192.168.11.3.389 root 816 nscd 49232 0 128872 0 ESTABLISHED
127.0.0.1.5010 127.0.0.1.51811 root 4884 vntsd 139060 0 130880 0 ESTABLISHED
169.254.182.77.12 169.254.182.76.24 root 4930 fmd 64096 0 128872 0 ESTABLISHED
192.168.11.2.22 192.168.11.3.49363 root 4172 sshd 61952 31 128544 0 ESTABLISHED
Local Address Remote Address User Pid Command Swind Send-Q Rwind Recv-Q State
-------------------- -------------------- -------- ------ ------------- ------- ------ ------- ------ -----------
127.0.0.1.59101 127.0.0.1.5011 root 6364 telnet 130880 0 139264 0 ESTABLISHED
127.0.0.1.5011 127.0.0.1.59101 root 4884 vntsd 139060 0 130880 0 ESTABLISHED
192.168.11.2.46829 192.168.11.3.389 root 816 nscd 49232 0 128872 0 ESTABLISHED
127.0.0.1.5010 127.0.0.1.51811 root 4884 vntsd 139060 0 130880 0 ESTABLISHED
169.254.182.77.12 169.254.182.76.24 root 4930 fmd 64096 0 128872 0 ESTABLISHED
192.168.11.2.22 192.168.11.3.49363 root 4172 sshd 61952 31 128544 0 ESTABLISHED
<<output truncated>>
With "-v" verbose flag netstat prints the program name with full path information including other information.
t5-2@~# netstat -nu -P tcp -v
TCP: IPv4
Local/Remote Address Swind Snext Suna Rwind Rnext Rack Rto Mss State User Pid Command
-------------------- ------- -------- -------- ------- -------- -------- ----- ----- ----------- -------- ------ --------------
127.0.0.1.59101
127.0.0.1.5011 130880 eb88eb26 eb88eb26 139264 a9687631 a9687631 1125 8180 ESTABLISHED root 6364 /usr/bin/telnet 0 5011
127.0.0.1.5011
127.0.0.1.59101 139060 a9687631 a9687631 130880 eb88eb26 eb88eb26 1125 8180 ESTABLISHED root 4884 /usr/lib/ldoms/vntsd -i virtual-console-concentrator@0 -p localhost -t 0
192.168.11.2.22
192.168.11.3.44826 42112 aa006f8f aa006f4f 128544 d23c83de d23c83de 685 1248 ESTABLISHED root 4172 /usr/lib/ssh/sshd
192.168.11.2.63024
192.168.11.3.389 49232 cd6ad3cc cd6ad3cc 128872 ce3c602e ce3c602e 203 1448 CLOSE_WAIT root 816 /usr/sbin/nscd
Local/Remote Address Swind Snext Suna Rwind Rnext Rack Rto Mss State User Pid Command
-------------------- ------- -------- -------- ------- -------- -------- ----- ----- ----------- -------- ------ --------------
127.0.0.1.59101
127.0.0.1.5011 130880 eb88eb26 eb88eb26 139264 a9687631 a9687631 1125 8180 ESTABLISHED root 6364 /usr/bin/telnet 0 5011
127.0.0.1.5011
127.0.0.1.59101 139060 a9687631 a9687631 130880 eb88eb26 eb88eb26 1125 8180 ESTABLISHED root 4884 /usr/lib/ldoms/vntsd -i virtual-console-concentrator@0 -p localhost -t 0
192.168.11.2.22
192.168.11.3.44826 42112 aa006f8f aa006f4f 128544 d23c83de d23c83de 685 1248 ESTABLISHED root 4172 /usr/lib/ssh/sshd
192.168.11.2.63024
192.168.11.3.389 49232 cd6ad3cc cd6ad3cc 128872 ce3c602e ce3c602e 203 1448 CLOSE_WAIT root 816 /usr/sbin/nscd
<<output truncated>>
To display all TCP, UDP, Domain sockets you can use "-au"
# netstat -aun
UDP: IPv4
Local Address Remote Address User Pid Command State
-------------------- -------------------- -------- ------ -------------- ----------
*.* root 107 in.mpathd Unbound
*.* root 107 in.mpathd Unbound
*.* netadm 712 nwamd Unbound
*.* netadm 712 nwamd Unbound
*.111 daemon 3080 rpcbind Idle
*.* daemon 3080 rpcbind Unbound
*.58525 daemon 3080 rpcbind Idle
*.111 daemon 3080 rpcbind Idle
*.* daemon 3080 rpcbind Unbound
*.46768 daemon 3080 rpcbind Idle
Local Address Remote Address User Pid Command State
-------------------- -------------------- -------- ------ -------------- ----------
*.* root 107 in.mpathd Unbound
*.* root 107 in.mpathd Unbound
*.* netadm 712 nwamd Unbound
*.* netadm 712 nwamd Unbound
*.111 daemon 3080 rpcbind Idle
*.* daemon 3080 rpcbind Unbound
*.58525 daemon 3080 rpcbind Idle
*.111 daemon 3080 rpcbind Idle
*.* daemon 3080 rpcbind Unbound
*.46768 daemon 3080 rpcbind Idle
<<output truncated>>
With this feature netstat can be alternative for lsof for looking up port related information.
If you compile and run lsof from the source in Solaris. Use lsof "-i4" flag to display open ports in Solaris to display ports associated with IPv4 .
# ./lsof -i4 |head
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
in.mpathd 107 root 3u IPv4 0xc40046b332c0 0t0 TCP localhost:5999 (LISTEN)
in.mpathd 107 root 5u IPv4 0xc400469f6080 0t0 UDP *:* (Unbound)
nwamd 712 netadm 5u IPv4 0xc40048ea4100 0t0 UDP *:* (Unbound)
rpcbind 3080 daemon 8u IPv4 0xc400499eac00 0t0 UDP 0.0.0.17:chargen (Idle)
rpcbind 3080 daemon 9u IPv4 0xc400499ea700 0t0 UDP 0.0.0.17:chargen (Unbound)
rpcbind 3080 daemon 10u IPv4 0xc400499ea200 0t0 UDP 0.0.0.17:chargen (Idle)
rpcbind 3080 daemon 11u IPv4 0xc400499b5200 0t0 TCP *:* (LISTEN)
rpcbind 3080 daemon 12u IPv4 0xc400499b49c0 0t0 TCP *:* (IDLE)
nfs4cbd 3155 daemon 7u IPv4 0xc400499b3100 0t0 TCP *:* (LISTEN)
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
in.mpathd 107 root 3u IPv4 0xc40046b332c0 0t0 TCP localhost:5999 (LISTEN)
in.mpathd 107 root 5u IPv4 0xc400469f6080 0t0 UDP *:* (Unbound)
nwamd 712 netadm 5u IPv4 0xc40048ea4100 0t0 UDP *:* (Unbound)
rpcbind 3080 daemon 8u IPv4 0xc400499eac00 0t0 UDP 0.0.0.17:chargen (Idle)
rpcbind 3080 daemon 9u IPv4 0xc400499ea700 0t0 UDP 0.0.0.17:chargen (Unbound)
rpcbind 3080 daemon 10u IPv4 0xc400499ea200 0t0 UDP 0.0.0.17:chargen (Idle)
rpcbind 3080 daemon 11u IPv4 0xc400499b5200 0t0 TCP *:* (LISTEN)
rpcbind 3080 daemon 12u IPv4 0xc400499b49c0 0t0 TCP *:* (IDLE)
nfs4cbd 3155 daemon 7u IPv4 0xc400499b3100 0t0 TCP *:* (LISTEN)
<<output truncated>>
