LFCS · Question #297
While performing a security audit, an administrator discovers that a machine is accepting connections on TCP port 184, but it is not obvious which process has the port open. Which of the following…
The correct answer is E. lsof. To identify which process is listening on a specific TCP port, the administrator should use the lsof command.
Question
Options
- Atraceroute
- Bstrace
- Cdebug
- Dnessus
- Elsof
How the community answered
(64 responses)- B2% (1)
- C2% (1)
- D5% (3)
- E92% (59)
Why each option
To identify which process is listening on a specific TCP port, the administrator should use the `lsof` command.
`traceroute` maps the network path to a destination and does not show local port usage or the processes holding them.
`strace` traces system calls and signals of a process, useful for debugging a running process, but not for identifying an unknown process listening on a port.
`debug` is a generic term and not a specific Linux command for this task.
`nessus` is a vulnerability scanner, used for identifying security flaws, not for directly identifying the local process holding a specific open port.
The `lsof` (list open files) command can display information about files opened by processes, including network sockets. Using `lsof -i :184` will precisely show the process ID (PID) and command name of the process that has TCP port 184 open and is currently accepting connections.
Concept tested: Identifying listening processes by port
Source: https://manpages.ubuntu.com/manpages/jammy/en/man8/lsof.8.html
Topics
Community Discussion
No community discussion yet for this question.