Which ports in use? Who opened them?

Two questions I get frequently asked is:

• How do I figure which ports are in use?
• How do I figure which program is holding this port open?

Q. How do I figure which ports are in use?
A. Every OS with TCP/IP as a network stack includes a command called netstat. Use
netstat -na
to display all open port numbers.

The -a and -n are probably the most portable command options to netstat. You can fine-tune the output - say for example you want to see only TCP ports and not UDP, IPv4 only and not IPv6, etc. Those are pretty OS specific options tho'. For example, Linux's netstat has the option -l to list only listening ports. The netstat version supplied with Windows 2000 or Solaris does not have an equivalent option! It's best to check up the help text (man pages on U*x) to determine the supported options

Q. How do I figure which program is holding port open?
A. Use lsof. In particular, use
lsof | grep "nn"
to figure the process holding the port open. Of course you can also use
lsof| grep -i "progname"
to figure the ports the program progname has open.

It may not be present on all U*x machines, but no big deal - download the sources off ftp://ftp.cerias.purdue.edu/pub/tools/unix/sysutils/lsof and compile. At least you get prebuilt binaries for Linux and Solaris. Other than these platforms, lsof works fine with AIX 5, Apple Darwin 7.7.0, *BSD, HP-UX and Tru64 UNIX 5.1. Sorry, lsof doesn't do Windows. Use Sysinternal's Process Explorer to determine open ports for Windows machines.