how to investigate ports opened by a certain process in linux?

Question

Suppose the PID of the process is already known

Answer 1

Have a look at lsof, that should do the trick.

Answer 2

You can use the netstat command line tool with the -p command line argument:

-p Linux: Process : Show which processes are using which sockets (similar to -b under Windows) (you must be root to do this)

The example section gives this example:

To display all ports open by a process with id pid
netstat -ao | find "pid"

Answer 3

As a side note, netstat -ao will read the /proc/pit/tcp etc to see the open ports by the process. This means that its reading information supplied by the system(the linux KERNEL), and is in no way directly looking on the network interface or other means. Same goes for lsof. If you are doing this as a security measure, you failed. You should never(NEVER EVER) trust the output of netstat, even if you are 100% sure you are in fact running a real netstat program(as opposed to a trojaned version) or any other program that reads the /proc filesystem. Some people seem to think that netstat, ls, ps or any other of hte stantard unix tools do some sort of magic and poll information from the sources, the truth is all of them relly on the /proc filesystem to get all of there data, which can be easily subverted by a rootkit or hypervisor.

Answer 4

netstat --all --program | grep '3265'

-all show listening and non-listening sockets.
--program show the PID and name of the program to which socket belongs.

You could also use a port scanner such as nmap.