Re: [PLUG] how to tell which process binds to which port?

["Michael C. Toren" <mct@toren.net>]

> I have a strange process binding to port 868 (unknown). I wonder how to
> find out what process is bound there so I can destroy it.
> 
> I am finding that this unknown process binds to a port in the mid-800's
> each time I reboot. I keep blocking each port w/ ipchains, but this is not
> solving the underlying problem.

netstat(8) has a "-p" command line argument to display the PID associated
with each network connection, and a "-e" argument to also display the
username associated with that process.  Or, you can use the "-i" argument
of lsof(8) to list any open file descriptions associated with an internet
protocol.

> Am I hacked?

Hard to say with such little information, however something to keep in
mind is that if you have been, you may not be able to trust the output
of netstat or lsof, anyway.

-mct