Lsof not showing what port a proc is listening on

lsofnetstatsolarisunix

I have many processes on a box listening on several ports.
I am trying to map ports to pids.
The problem is that lsof is not telling me what ports belong to which process.

Given an apache listening on port 80, I can see it listening via netstat:
user@host% netstat -an|grep LISTEN|grep 80
*.80 *.* 0 0 49152 0 LISTEN

But when I try to map port 80 to a pid I get nothing:
user@host% lsof -iTCP:80 -t

When I try seeing what sockets that specific pid is using I get:
user@host% lsof -lnP -p31 -a -i
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
libhttpd. 31 0 15u IPv4 0x6002d970b80 0t0 TCP *:65535 (LISTEN)

Notice the *:65535 in the NAME column.

Does anyone know why lsof is not reporting the port in use?

I am running as root.
I am using a mix of lsof and os versions:
lsof v4.77 on Solaris10 sparc
lsof v4.72 on Redhat4.2
etc

I know that linux solutions can use "netstat -p",
so I guess I'm only looking for why solaris isn't working,
but I find lsof is frequently silent and not showing me expected data.

Best Answer

You'd rather use pfiles which is part of Solaris and supported by Sun, unlike lsof.

Its usage is slightly different as it expects a pid as argument but you can achieve what you want with something like:

pfiles $(pgrep libhttpd)

or even, if you don't know the process name:

pfiles /proc/*

Related Solutions

Netstat Issue – Netstat Shows a Listening Port with No PID but lsof Does Not

From data you provided I'd say it's related to some NFS mounts or something using RPC.

you can check with rpcinfo -p for ports that might be used by some of RPC related services.

Here is how it looks on my system

# netstat -nlp | awk '{if ($NF == "-")print $0}'
tcp        0      0 0.0.0.0:55349           0.0.0.0:*               LISTEN      -               
udp        0      0 0.0.0.0:18049           0.0.0.0:*                           - 

# rpcinfo -p
   program vers proto   port
    100000    2   tcp    111  portmapper
    100000    2   udp    111  portmapper
    100024    1   udp  10249  status
    100024    1   tcp  10249  status
    100021    1   udp  18049  nlockmgr
    100021    3   udp  18049  nlockmgr
    100021    4   udp  18049  nlockmgr
    100021    1   tcp  55349  nlockmgr
    100021    3   tcp  55349  nlockmgr
    100021    4   tcp  55349  nlockmgr

Linux – Difference Between `lsof -p | wc -l` and `ls /proc//fd | wc -l`

lsof will also give you memory mapped .so-files - which technically isn't the same as a file handle the application has control over. /proc/<pid>/fd is the measuring point for open file descriptors - however: Mentioned in the proc-man page - if the main thread of a multithreaded program has terminated, this directory will be unavailable.

lsof -p <pid> | grep -v mem | egrep -v '^COMMAND PID' | wc -l will show you the same items as ls /proc/<pid>/fd | wc -l.

The memory maps is available in /proc/<pid>/maps.

Related Topic