When troubleshooting applications you will sometimes need to find out what process is using your ports so that you can isolate it or kill it or readjust it so that it will work better with other applications on the same server.
lsof is always the best method to see what is running on various ports however there is also an alternative.
lets do lsof first
lets say you want to find out what is running on port 8400 since it states that the port is open via netstat
netstat -an | grep 8400
tcp 0 0 0.0.0.0:8400 0.0.0.0:* LISTEN
so you can issue lsof -i and grep for LISTEN
# lsof -i | grep LISTEN
EvMgrC 5677 root 3u IPv4 16534715 0t0 TCP *:abarsd (LISTEN)
cvd 5683 root 4u IPv4 16534886 0t0 TCP *:58576 (LISTEN)
cvd 5683 root 8u IPv4 16534893 0t0 TCP *:cvd (LISTEN)
sshd 7256 root 3u IPv4 23743 0t0 TCP *:ssh (LISTEN)
master 7353 root 11u IPv4 24108 0t0 TCP localhost.localdomain:smtp (LISTEN)
PatrolAge 8571 patagt 14u IPv4 10488922 0t0 TCP *:bmcpatrolagent (LISTEN)
csampmuxf 22550 root 1u IPv4 5303942 0t0 TCP *:cacsambroker (LISTEN)
cupsd 23847 root 4u IPv4 15203344 0t0 TCP localhost.localdomain:ipp (LISTEN)
Xvnc 27702 oracle 1u IPv4 12346599 0t0 TCP localhost.localdomain:5903 (LISTEN)
The back thing about this is that you'll have to reference /etc/services to find out what ports each of these services map to such as ssh/abarsd/cvd/bmcpatrolagent/cacsambroker and then you can find the PID
An alternative to this is also pretty simple to do and use. it requires fuser.
look above and we see that port 8400 is TCP so we want to see whats running for that via fuser
# fuser 8400/tcp
8400/tcp: 5683
so you see that the PID is 5683 so goto /proc/PID and take a look at the exe
# ls -l /proc/5683/exe
lrwxrwxrwx 1 root root 0 Nov 20 09:47 /proc/5683/exe -> /opt/simpana/Base/cvd
you can see that its this process with PID 5683 that was executed with the line /opt/simpana/Base/cvd that is bound to that port.
