Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am running a server application (written in C), that is bound to my server on localhost address and let it listen in first case on port 10000 and in second case on port 20000

When I run command I lsof | grep IP in last column is:

  • localhost:webmin (LISTEN) (first case)
  • localhost:20000 (LISTEN) (second case)

So instead of port 10000 there is webmin.

What does this mean? I found this.

It says that Webmin is a web-based interface for system administration for Unix. This doesn't help me; why am I seeing webmin in my port list?

share|improve this question

migrated from Feb 19 '12 at 23:48

This question came from our site for professional and enthusiast programmers.

It means it's "a well known port" – Ben Voigt Feb 19 '12 at 23:46
It sounds like your system thinks port 10000 is a "well-known port" used by this webmin server, and is using the string webmin as an alias for that port number... – Reuben Feb 19 '12 at 23:47
Thank you for help. – user1097772 Feb 20 '12 at 0:10
up vote 7 down vote accepted

webmin is associated with port 10000. lsof is "deducing" that webmin is what is running. For instance, if your app was bound to port 3306, lsof would think it was MySQL.

See this Wikipedia link for a list of well-known ports.

share|improve this answer
Thank you for help. – user1097772 Feb 20 '12 at 0:10
lsof is not deducing that webmin is running. It just replaces the numeric representation of the port with the human readable format of the port/service found in /etc/services unless you call lsof with the -n option. – Flow Feb 20 '12 at 9:41
Yes.... which is a form of deduction, for some meaning of that word. – Mahmoud Al-Qudsi Feb 20 '12 at 21:26
Anthropomorphizing system processes is a sign of not understanding what is actually occurring. – Magellan Feb 21 '12 at 21:32
That's why "deducing" is in quotes in my reply. For some definition of the word, it is "deducing", even if only via naive substitution of values in an attempt to make its output more understandable to you, the user. – Mahmoud Al-Qudsi Feb 21 '12 at 22:22

It basically means that port 10000 is assocsiated with webmin in your /etc/services file.

share|improve this answer
Thank you for help. – user1097772 Feb 20 '12 at 0:10
@user1097772, just so you know, this is the file where the "well known" ports mentioned by others are defined. – John Gardeniers Feb 20 '12 at 0:17
@JohnGardeniers nope, but I know it since now :] thx ;) – user1097772 Feb 20 '12 at 0:21

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.