Originally posted by: tips_luo

The TSCM alert there is a port 113 response, but I don't see this port via
netstat -an|grep LISTEN

I search on the internet, it is a port of identd. Now I try to know which process listens this port, and when it listen. How can we do it? Thank anybody.

Originally posted by: ostost

You can try netstat and kdb to find out the process.

First use netstat -Aan to display the process control block of the socket. Below an example which shows that the process on port 22 is sshd.

# netstat -Aan
[...]
f100060000cfd398 tcp4 0 0 *.22 . LISTEN
[...]

Then use kdb to find the process

# echo "sockinfo f100060000cfd398 tcpcb" | kdb |grep proc
F100070F00000000 F100070F10000000 pvproc+000000
proc/fd: 101/3
proc/fd: fd: 3
pvproc+019400 101*sshd ACTIVE 00650EA 003008C 00000001E02FF480 0 0001

Originally posted by: Kosala

thanx ostost, this is useful info.

For the original post, if the port 113 is bound to UDP, then grep LISTEN will not list the port. Just a possibility.

Originally posted by: tips_luo

Thank you all.
Now I am suspecting the server is listening on a UDP port. Since I cannot use netstat to see it , and it cannot be scanned because it is behind the firewall, how can I know whether there really is a UDP 113 listening?

Originally posted by: Kosala

That's not exactly correct. Netstat does show the UDP listening ports. Only that there is no LISTEN state. Try the following.

1. netstat -an -f inet | grep 113

Ths might return more than one line... but one of them definitely will be your line.

Originally posted by: tips_luo

No thing output when I execute netstat -an -f inet | grep 113
I am suspecting there is 113 tcp/udp port listening or not.