Finding process using ports

To find out which process is using port number 35541 in a CentOS 7 system (or any Linux distribution), you can use the following methods:

1. Using lsof (List Open Files)

The lsof command can list all open files and network connections, and you can filter by the specific port:

sudo lsof -i :35541

This will show the process that is using port 35541. The output will contain columns for the command, PID (process ID), and other information.

2. Using netstat

If netstat is installed, you can use it to check for connections on a specific port:

sudo netstat -tuln | grep 35541

This will show which process is listening on that port. If you need the process ID (PID), use the following command:

sudo netstat -tulnp | grep 35541

3. Using ss (Socket Statistics)

The ss command is often recommended as a modern replacement for netstat:

sudo ss -tuln | grep 35541

To include the process ID:

sudo ss -tulnp | grep 35541

4. Using fuser

You can also use fuser, which shows which processes are using files or sockets:

sudo fuser 35541/tcp

35541/tcp: 30408

Using fuser to identify the process occupying the port and then restarting it is an effective approach to address such conflicts.

This will return the process ID (PID) that is using the port.

Once you get the PID, you can get more information about the process by running:

ps -p <PID>

Replace <PID> with the actual process ID obtained from one of the above methods.

If netstat didn't show the process as listening on port 35541, then it's likely that the port was being used by a client connection rather than a server process.

In TCP/IP networking, a process can bind to a local ephemeral port when making outbound connections as a client. The fact that port 35541 was in use by process 30408 suggests that it was likely a client-side connection, where the process was using 35541 as the source port for an outbound connection.

Here's a more detailed breakdown:

• Listening port (server) : The process listens on a specific port, usually waiting for incoming connections. This would show up in netstat as LISTEN if it were a server process.
• Client-side port : When a process initiates an outgoing TCP connection, the operating system assigns a source port , often from a range of ephemeral ports. These ports are usually dynamically assigned and temporary. The port 35541 was likely used in this capacity by process 30408.

To confirm this hypothesis:

1. You could check all active connections, not just listening ones:

   sudo netstat -anp | grep 30408

   This would show any connections (both listening and established) made by the process with PID 30408.

2. Similarly, using ss to list all connections for this process:

   sudo ss -ap | grep 30408

   This should show both inbound and outbound connections, confirming the client-side use of port 35541.

By restarting the process, the client-side connection was reset, likely freeing up the port.