List Process tied to Port

List a Processes tied to a Port

1. Determine the tcpcb (TCP Control Block) tied to the port.
   1. # netstat -Aan -f inet
   2. The output should be similar to the following.

Active Internet connections (including servers)
PCB/ADDR         Proto Recv-Q Send-Q  Local Address      Foreign Address    (state)
f1000e0000527bb8 tcp        0      0  *.*                   *.*                   CLOSED
f1000e00005233b8 tcp4       0      0  *.*                   *.*                   CLOSED
f1000e001380dbb8 tcp4       0      0  *.13                  *.*                   LISTEN
f1000e0007a133b8 tcp        0      0  *.21                  *.*                   LISTEN
f1000e0000f28bb8 tcp6       0      0  *.22                  *.*                   LISTEN
f1000e0000f283b8 tcp4       0      0  *.22                  *.*                   LISTEN

1. 1. The first column PCB/ADDR will be used.
2. The rmsock command will be used to identify the process associated with the TCPCB.
   1. # rmsock <PCB/ADDR> tcpcb
   2. The output will be similar to the following.
      1. The socket 0xf1000e0000527808 is being held by proccess 5505230 (rmcd).
   3. Example.
      1. # rmsock f1000e0000527bb8 tcpcb

Further Reading

• Using netstat and rmsock to Identify Processes