Originally posted by: SystemAdmin

Hi all,

Can someone tell me which command to use to know all the port numbers used and by which process on an AIX server ?

Thanks in advance,
#AIX-Forum

Originally posted by: SystemAdmin

To associate port usage to a service, "netstat -a". To associate port usage to running processes, you need "lsof" out of your Toolbox for Linux Applications. It is unsupported, but it works.
#AIX-Forum

Originally posted by: SystemAdmin

Thank you.

I've done a netstat -a , i've got something like
tcp4 0 0 *.8080 . LISTEN

I've would like to know which process/socket is ?
Can i change it ? and where i can change it ?
because i need this port for a nother thing (my jboss application server).

Best regards
#AIX-Forum

Originally posted by: SystemAdmin

We could guess, but lsof would tell you exactly what it is. That is usually the port used for http proxies, but I have seen it used for admin consoles of web servers and so on. If you can get lsof on the server, you will find out with:

lsof|grep 8080

It will echo back the process using the socket.

Best of luck to you!

SG
#AIX-Forum

Originally posted by: SystemAdmin

Hi,

Thank you for responding but unfortunately, lsof doesn't work on my server.

1. lsof | grep 8080

ksh: lsof: not found

I also tried to look for 8080 by grep 8080 /etc/* but there's nothing.

Best regards.
ditrmas

#AIX-Forum

Originally posted by: SystemAdmin

This utility can be obtained from the Linux Toolkit for AIX CD, The AIX toolbox for Linux on the web at http://www-1.ibm.com/servers/aix/products/aixos/linux/ , or from ftp://vic.cc.purdue.edu/pub/

With this utility you can get process information for any open file and the ports are treated by UNIX as open files. To look at the process information for say port

lsof -i | grep 5901
Xvnc 33152 jwtesch 6u IPv4 0x7006d1f0 0t0 TCP *:5901 (LISTEN)

This can be useful if you find a port with a lot of network traffic that may be hurting the performance, but don't know the process that is using the port.
For a complete list of all the processes that are using the network you can use the following script.

Shell script source
#!/bin/ksh
#script title=/tmp/port-process.ksh
netstat -a|grep LISTEN|awk '{print $4}'>/tmp/port.list
for PORT in `cat /tmp/port.list`
do
/usr/sbin/lsof -i | grep $PORT
done
echo "script exection $0 completed"

Sample Output
inetd 12540 root 11u IPv4 0x701ef9f0 0t0 TCP *:daytime (LISTEN)
inetd 12540 root 14u IPv4 0x701e8400 0t0 UDP *:daytime
inetd 12540 root 4u IPv6 0x7006e9f0 0t0 TCP *:ftp (LISTEN)
sshd 10944 root 3u IPv4 0x7006ddf0 0t0 TCP *:ssh (LISTEN)
inetd 12540 root 5u IPv6 0x701ecdf0 0t0 TCP *:telnet (LISTEN)
sendmail 33648 root 9u IPv4 0x704159f0 0t0 TCP *:smtp (LISTEN)
inetd 12540 root 12u IPv4 0x701ef5f0 0t0 TCP *:time (LISTEN)
inetd 12540 root 15u IPv4 0x701e8700 0t0 UDP *:time

#AIX-Forum

Originally posted by: SystemAdmin

There is a non lsof way as well. Run netstat -Aa and look for the string showing 8080 in a listen stats. Take the number at the beginning of that string and then run "kdb".

At the prompt run "sockinfo number tcpcb" and you will get a load of output of which at the very bottom you should get the process name and number.

(I would have pasted an example but am not logged onto a box at the moment.)

Thanks,

Sam
#AIX-Forum

Originally posted by: MarkTaylor

lsof -i:$PORT would be a more efficient way of doing things in your script ...

also, "rmsock address tcpcb" also works rather than going into kdb ..

i.e.

####:root /root $ netstat -Aan | grep 6000
f1000200003dfb90 tcp4 0 0 *.6000 . LISTEN

####:root /root $ rmsock f1000200003dfb90 tcpcb
The socket 0x3df800 is being held by proccess 139332 (X).

HTH
Mark Taylor
#AIX-Forum