Becoming a Linux Server Detective 🕵️‍♂️ How to Trace Processes by Port Number and Find the Master Process

Hello! When managing Linux servers, you often encounter questions like, “Hmm? Which service is using port 80 right now?” or “This web server has multiple processes, but which one is the real main process?”

Today, we’ll take some time to become ‘Linux Detectives’ to solve these mysteries. Let’s embark on an exciting journey, starting with a single clue – a port number – to identify the suspects (processes) and even uncover the master process behind them! 🕵️‍♀️

Step 1: The First Clue – Finding Process Suspects by Port Number 📡

Every investigation starts with a small clue. Our first clue is the ‘port number’. By checking who is receiving requests on a specific port, we can identify the processes to put on our suspect list.

The most modern and powerful tool for this is the ss command. (While netstat is a classic tool, ss is faster and provides more information.)

sudo ss -tlpn | grep ':[포트번호]'

# Let's find port 80 as an example.
sudo ss -tlpn | grep ':80'

The command might look a bit complex, but it’s simple once you understand the options.

• -t: Show only TCP protocols.
• -l: Show only Listening (waiting for connection) states.
• -p: Show Process information using that port. (Most important!)
• -n: Show port numbers or IP addresses in Numeric form. (For quick verification)

Running this command will give you results similar to this:

LISTEN 0  511  0.0.0.0:80  0.0.0.0:* users:(("apache2",pid=1337,fd=4))

Aha, the culprit has been identified! Looking at the users: section, we confirmed that an application named apache2 is running with PID (Process ID) 1337 and occupying port 80. First investigation step complete!

Step 2: In-depth Investigation – Unraveling the Process Hierarchy 👨‍👩‍👧

Although we’ve identified apache2 as a suspect, the investigation doesn’t end here. If you query the apache2 process with the ps command, you’ll find that multiple processes are running simultaneously.

This is because programs like web servers operate with a structure where one master process creates and manages multiple worker processes for efficient task handling. It’s like a restaurant manager (master) overseeing several chefs and serving staff (workers). 🍳

Our mission is to find the real ‘boss’ among them, the master process. The command we use for this is ps -ef.

ps -ef | grep apache2

The results will appear similar to the following:

UID    PID   PPID   C STIME TTY      TIME     CMD
root   1337     1    0 10:30 ?    00:00:00   /usr/sbin/apache2 -k start
www-data 1380  1337   0 10:30 ?    00:00:00   /usr/sbin/apache2 -k start
www-data 1381  1337   0 10:30 ?    00:00:00   /usr/sbin/apache2 -k start

Let’s find the decisive evidence pointing to the master process here.

• Evidence 1: The executing user (UID) is root.
• Master processes typically run as the root account because they require high privileges to access system resources and open ports. Worker processes, on the other hand, run with lower-privileged users (e.g., www-data) for security reasons.
• Evidence 2: The Parent Process ID (PPID) is 1.
• A PPID of 1 means that the process was directly launched by the first process executed during system boot (systemd or init). In other words, it’s the ‘ancestor’ of this process tree.
• Evidence 3: This process is the parent of other workers.
• Look at the PPID of other apache2 processes. Do they all point to 1337? This is the most conclusive evidence that PID 1337 is their parent, i.e., the master process.

All evidence points to PID 1337 as the master process.

Step 3: Writing the Investigation Report – Safely Saving Results to a File ✍️

Now that the investigation is complete, we need to document the results. Let’s save the discovered application name (lowercase) and the master PID to a file like /opt/process.txt.

A word of caution here! System directories like /opt or /etc require root privileges to create files. Many people make the mistake of sudo echo “content” > /opt/file.txt. In this command, only echo runs with sudo, while the file writing operation (>) runs with the current user’s permissions, leading to a ‘Permission denied’ error.

The safest and most reliable method is to use the tee command.

printf "apache2
1337
" | sudo tee /opt/process.txt

This command works as follows:

1. printf “apache2n1337”: Generates the text “apache2” on the first line, followed by a newline (represented as

   in the explanation), and “1337” on the second line.

2. | (pipe): Passes the generated text as input to the next command.
3. sudo tee /opt/process.txt: Executes tee with root privileges. tee writes the input received via the pipe to both the screen and the file simultaneously. This allows you to safely create the file without permission issues.

Conclusion

Congratulations! You are now a capable Linux server detective. 🎉

Today, we started with a small clue – a port number (ss) – unraveled the process family tree (ps -ef) to find the master process, and learned how to neatly save the investigation results to a file (tee) without permission issues.

These three commands are essential skills for monitoring systems and troubleshooting problems, so be sure to remember them and apply them in your actual server operations!

---

Tags: Linux, 리눅스, Server Management, System Engineering, DevOps, Process, Port, PID, ss, ps, tee