Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

On Linux, is there a way to figure out what process was using a port, before it went into TIME_WAIT state.

When I use netstat -tnp I just see two end points, but no process information.

Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name

tcp        0      0                  TIME_WAIT   -
share|improve this question

In my case, tracing socket opens greatly helps me to spot TIME_WAIT states (since typically means that my application is repeatedly creating sockets)

Based on how i can identify which process is making UDP traffic on linux? , I tried auditcl. "-S socket" does not work in my ubuntu, but the code below (optionally adding -F pid=pgrep -x yourApplication ) is quite good spotting socket creations

auditctl -a exit,always   -S socketcall -F uid=$USER -F a0=1 -F a3=1  -k OPEN_SOCKETS
share|improve this answer

No, the system just doesn't keep track of this.

TCPView shows quite clearly that closed sockets which fall in the TIME_WAIT state are instantly re-assigned to process 0 (System).

Sorry, I misread your question; the above answer refers to Windows systems.
However, I think the same happens on Linux systems, too.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.