On my system, if I run the netstat for a port, it returns:

$ netstat -nat | grep "60964"
tcp        0      0   *            LISTEN      
tcp       59      0         ESTABLISHED

If I run lsof:

$ lsof -i4 | grep "60964"
process_x  2585 root  189u  IPv4  12708      0t0  TCP (LISTEN)

Why is there a difference in the output here? Why isn't lsof detecting the "established" connection.


Edit: I should mention I am the running the above commands as root.

  • In that case, are you sure lsof -i4 .... really prints single line then exits, and not just hang there? – Abel Cheung Jul 11 '15 at 19:10
  • Yes, it exits after printing one line. – brokenfoot Jul 11 '15 at 19:19

Unlike netstat, lsof requires root privileges in order to print all open ports on system. Although lsof manpage recommends lsof to be installed setuid root on Linux and setgid on BSD and many other Unixes, in fact most installations choose not to do so. (Whether those permissions should be turned on is another question.)

Therefore lsof displays connection for any process executed by current user only. To get a full list of connections, run lsof with root privilege.

| improve this answer | |
  • 1
    But I am running the above commands as root. – brokenfoot Jul 11 '15 at 15:49

Have you tried

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.