Can't find the owner of a port

Support Network
1

i have an open port i’m curious about

0.0.0.0:41615

neither netstat, lsof, fuser nor ss can tell me what process owns that port

$ sudo netstat -nlp
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 127.0.0.1:631           0.0.0.0:*               LISTEN      907/cupsd
tcp        0      0 127.0.0.1:53            0.0.0.0:*               LISTEN      860/dnscrypt-proxy
tcp6       0      0 ::1:631                 :::*                    LISTEN      907/cupsd
udp        0      0 127.0.0.1:53            0.0.0.0:*                           860/dnscrypt-proxy
udp        0      0 0.0.0.0:41615           0.0.0.0:*                           -
udp6       0      0 :::41615                :::*                                -
2

Is this port listed in /etc/services?

Are you using python & tensorflow? In a bug report there’s something like yours:

INFO:tensorflow:Using local port 41615
I0627 23:02:57.102149 139801719478080 test_util.py:3796] Using local port 41615
2023-06-27 23:02:57.103351: I tensorflow/core/data/service/worker_impl.cc:186] Worker registered with dispatcher running at localhost:43055
2023-06-27 23:02:57.103477: I tensorflow/core/data/service/server_lib.cc:82] Started tf.data WorkerServer running at 0.0.0.0:41615

3

‘nope’ to both questions

tensorflow was the only reasonable reference i found to that port, but it’s not installed

1 Like
4

Did you search the grand o’l internet?

41615/udp - sx.nix.dk

When an application opens an outgoing connection it will use an available local port and address a named remote port.

There may not be any owner - such as those defined in /etc/services (IANA) - for as long as there is no active services for a any owned port - applications may choose to use the port or port range for their own purpose.

If you really want to know what may use the port I suggest you add the -c/–continous argument to keep watching …

5

Hi @majik,

I don’t know if it’s installed by default, or how to install it if not, but you could try netstat:

netstat -ltnp | grep -w ':41615'

Where:

netstat  - Print network connections, routing tables, interface statis‐
=======================================================================

--numeric,-n
Show numerical addresses instead of trying to determine symbolic  host,
port or user names.

-p, --program
Show the PID and name of the program to which each socket  belongs.   A
hyphen is shown if the socket belongs to the kernel (e.g. a kernel ser‐
vice,  or the process has exited but the socket hasn't finished closing
yet).

-l, --listening
Show only listening sockets.  (These are omitted by default.)

grep - print lines that match patterns
======================================

-w, --word-regexp
Select  only  those  lines  containing  matches  that form whole
words.  The test is that the matching substring must  either  be
at  the  beginning  of  the  line,  or  preceded  by  a non-word
constituent character.  Similarly, it must be either at the  end
of  the  line  or  followed by a non-word constituent character.
Word-constituent  characters  are  letters,  digits,   and   the
underscore.  This option has no effect if -x is also specified.

Hope this helps!

6

…The OP example is netstat…

7

Yeah. Just noticed. :sweat_smile:

Then he doesn’t have to install it. :grin:

8

Here there’s an example about finding a port with - in netstat, may be you can identify yours the same way:

https://serverfault.com/a/847910

9

I think it’s also used by Brothers in Arms and Splinter Cell games servers. Port 41615 (tcp/udp) :: SpeedGuide .

10

don’t laugh - i was reading your post and i thought maybe i should do that :blush:

in my defense, i haven’t had my :coffee: yet

11

That is a good defense.

12

$ sudo netstat -ltpnae | awk 'NR==2 || /:<port>/' is empty in my case

i’m starting to wonder if the port isn’t opened by Thunderbird (IMAP) even though it remains after exiting T-bird???

13

If I remember correctly, you’ll will only get a result if the offending port is actively being listened on…so whatever uses it needs to be open…

Edit:

I just tested. You’ll pretty much get the same result with whichever one you use:

$ sudo netstat -ltpnae | grep ':22'
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      0          24205      724/sshd: /usr/bin/
tcp        0      0 10.0.0.20:34956         10.0.0.254:22           ESTABLISHED 0          7677066    768914/ssh
tcp        0      0 10.0.0.20:39212         193.150.22.84:22067     ESTABLISHED 1000       7723270    859/syncthing
tcp6       0      0 :::22                   :::*                    LISTEN      0          24207      724/sshd: /usr/bin/
tcp6       0      0 :::22000                :::*                    LISTEN      1000       15142      859/syncthing
tcp6       0      0 10.0.0.20:22000         10.0.0.254:22000        ESTABLISHED 1000       7708234    859/syncthing
tcp6       0      0 10.0.0.20:22000         10.0.0.100:22000        ESTABLISHED 1000       7701489    859/syncthing

Or the more complicated:

$ sudo netstat -ltpnae | awk 'NR==2 || /:22/'
Proto Recv-Q Send-Q Local Address           Foreign Address         State       User       Inode      PID/Program name
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      0          24205      724/sshd: /usr/bin/
tcp        0      0 10.0.0.20:34956         10.0.0.254:22           ESTABLISHED 0          7677066    768914/ssh
tcp        0      0 10.0.0.20:39212         193.150.22.84:22067     ESTABLISHED 1000       7723270    859/syncthing
tcp6       0      0 :::22                   :::*                    LISTEN      0          24207      724/sshd: /usr/bin/
tcp6       0      0 :::22000                :::*                    LISTEN      1000       15142      859/syncthing
tcp6       0      0 10.0.0.20:22000         10.0.0.254:22000        ESTABLISHED 1000       7708234    859/syncthing
tcp6       0      0 10.0.0.20:22000         10.0.0.100:22000        ESTABLISHED 1000       7701489    859/syncthing

The only difference is that the one that uses grep instead of awk gives the header as well:

$ diff <(sudo netstat -ltpnae | grep ':22') <(sudo netstat -ltpnae | awk 'NR==2 || /:22/')                                                                                                                                                            1 ↵
0a1
> Proto Recv-Q Send-Q Local Address           Foreign Address         State       User       Inode      PID/Program name

Which might or might not be useful.