Ubuntu – Check which process has open SCTP port in Linux

networkingUbuntu

Using Ubuntu Server 16. Something on my machine has an SCTP port open, and I need to find it and kill it (without rebooting).

lsof doesn't show SCTP sockets, only TCP and UDP.

I'm looking through all these network utilities, and SCTP support is surprisingly scarce for such an old standard. I got netstat to work with SCTP by building the bleeding edge net-tools from here. sudo netstat --sctp -tulpn shows some open SCTP connections but doesn't say which process has them. It only shows the PIDs for UDP and TCP sockets.

Best Answer

Sort of a hacky roundabout way but it seems to work for me. Hoping someone will find a better way, but my first thoughts (ss/netstat) don't seem to acknowledge SCTP.

First, use procfs to find the inode of the sctp connection:

$ cat /proc/net/sctp/eps
 ENDPT     SOCK   STY SST HBKT LPORT   UID INODE LADDRS
b6d72780 a8903800 2   10  48   123       0 1895802 0.0.0.0

Take that inode (1895802 in my example) and use lsof to find who owns it:

$ lsof -R | grep 1895802
socat      8697        2045             root    5u     sock    1895802      0t0       SCTP ENDPT: b6d72780 0.0.0.0[123]

As you can see, I was using socat to make a socket listening on 123/sctp. 8697 is the pid.

Related Question