So, you’ve run netstat -an and found something listening on a port you’re not sure what it is?

Not to worry, you can always run this command to find out;
Substitue $PORT with your actual port.

lsof -i | grep $PORT

So, say you’d run
netstat -an | grep LIST |grep tcp
and found this process
tcp 0 0 0.0.0.0:32803 0.0.0.0:* LISTEN
Not sure what 32803 was you checked /etc/services
grep 32803 /etc/services
and got nothing!

So, now you run
lsof -i | grep 32803
and you see

skype 18160 mdxdoug 22u IPv4 101807497 TCP *:32803 (LISTEN)
skype 18160 mdxdoug 23u IPv4 101807498 UDP *:32803

So it’s SKYPE! and not backdoor.pl or something. Good to know.

Enjoy!

NOTE:
If you’re using this to find a service that IS in /etc/services, you should grep for the service by name instead of port.

grep 143 /etc/services

imap 143/tcp imap2 imap4 #Interim Mail Access Protocol v2

lsof -L | grep imap