Which of the following commands can identify the PID od a process which opened a TCP port?

Question

Options

• Aptrace
• Bstrace
• Cdebug
• Dlsof
• Enessus

• A
  3% (1)
• B
  5% (2)
• C
  11% (4)
• D
  78% (29)
• E
  3% (1)

Explanation

lsof (List Open Files) is the correct answer because on Unix/Linux systems, everything is treated as a file - including network sockets. Running lsof -i TCP:<port> will show the process name, PID, and user associated with any process that has that TCP port open.

Why the distractors are wrong:

• ptrace is a system call used to observe and control another process's execution (used by debuggers), not for querying network connections.
• strace traces system calls made by a running process - useful for debugging, but it doesn't query which process owns a port.
• debug is not a standard Unix command relevant to process/port inspection.
• nessus is a vulnerability scanner used in security assessments, not a general-purpose process inspection tool.

Memory tip: Think of lsof as "Look up Socket Owner Fast" - when you need to find who opened a port, lsof -i :<port> gives you the PID immediately. Alternatively, ss -tulnp or netstat -tulnp are modern equivalents worth knowing for the exam.

No community discussion yet for this question.