In Redhat, we can easily get this using lsof. let's say if we want to know which program is listening on port 80.
[root@localhost ~]# lsof -i :80
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
httpd 2047 root 4u IPv6 12636 0t0 TCP *:http (LISTEN)
httpd 2049 apache 4u IPv6 12636 0t0 TCP *:http (LISTEN)
httpd 2050 apache 4u IPv6 12636 0t0 TCP *:http (LISTEN)
httpd 2051 apache 4u IPv6 12636 0t0 TCP *:http (LISTEN)
httpd 2052 apache 4u IPv6 12636 0t0 TCP *:http (LISTEN)
httpd 2053 apache 4u IPv6 12636 0t0 TCP *:http (LISTEN)
httpd 2054 apache 4u IPv6 12636 0t0 TCP *:http (LISTEN)
httpd 2055 apache 4u IPv6 12636 0t0 TCP *:http (LISTEN)
httpd 2056 apache 4u IPv6 12636 0t0 TCP *:http (LISTEN)
From the output, we know that httpd is listening on port 80.
Another way to get the process listening on certain port is using netstat.
[root@localhost ~]# netstat -anp | grep 80
tcp 0 0 :::80 :::* LISTEN 2009/httpd
[root@localhost ~]# ps -ef | awk '$2 == 2009'
root 2009 1 0 23:21 ? 00:00:00 /usr/sbin/httpd
[root@localhost ~]#
In AIX, most of the time it has no lsof installed, and the netstat is also different from Redhat, but we still can get our question answered.
$ netstat -Aan | grep '.22 ' | grep LISTEN
f1000e0001382bb8 tcp4 0 0 *.22 *.* LISTEN
$ rmsock f1000e0001382bb8 tcpcb
The socket 0xf1000e0001382808 is being held by proccess 3670142 (sshd).
$ ps -ef | grep 3670142
root 3670142 3014676 0 Sep 06 - 0:00 /usr/sbin/sshd
Please note rmsock will not remove the socket, you can confirm this by checking the content of /var
reference: http://unix.ittoolbox.com/groups/technical-functional/ibm-aix-l/determine-which-process-is-listening-on-a-port-without-using-lsof-on-aix-1468555
