While performing a security audit, you discover that a machine is accepting connections on TCP port 184, but it is not obvious which process has the port open.
Which of the following programs would you use to find out?
A.
traceroute
B.
strace
C.
debug
D.
nessus
E.
lsof
Explanation/Reference:
From the man pages:
lsof – list open files
-i This option selects the listing of files any of whose Internet address matches the address specified in i. If no address is specified, this option selects the listing of all Internet and x.25 (HP-UX) network files.
-n This option inhibits the conversion of network numbers to host names for network files. Inhibiting conversion may make lsof run faster. It is also useful when host name lookup is not working properly.
-P This option inhibits the conversion of port numbers to port names for network files. Inhibiting the conversion may make lsof run a little faster. It is also useful when port name lookup is not working properly.netstat -nap would get the same information.