Why is this port still open after I killed the process which occupied this port?

Curious Learner 0
Viewed 41

I typed this command in Windows cmd：

netstat -nao | findstr 9300

The output is:

  TCP    0.0.0.0:9300           0.0.0.0:0              LISTENING       6676
  TCP    10.206.90.163:59300    180.181.184.37:443     ESTABLISHED     1960
  TCP    127.0.0.1:9300         127.0.0.1:5907         ESTABLISHED     6676
  TCP    127.0.0.1:9300         127.0.0.1:5908         TIME_WAIT       0
  TCP    127.0.0.1:9300         127.0.0.1:5908         ESTABLISHED     6676
  TCP    127.0.0.1:9300         127.0.0.1:5909         TIME_WAIT       0
  TCP    127.0.0.1:9300         127.0.0.1:5913         TIME_WAIT       0
  TCP    127.0.0.1:9300         127.0.0.1:5914         TIME_WAIT       0
  TCP    127.0.0.1:9300         127.0.0.1:5914         ESTABLISHED     6676
  TCP    127.0.0.1:9300         127.0.0.1:5914         TIME_WAIT       0
  TCP    127.0.0.1:9300         127.0.0.1:5915         ESTABLISHED     6676
  TCP    127.0.0.1:9300         127.0.0.1:5917         TIME_WAIT       0
  TCP    127.0.0.1:9300         127.0.0.1:5917         TIME_WAIT       0
  TCP    127.0.0.1:9300         127.0.0.1:5917         TIME_WAIT       0
  TCP    127.0.0.1:9300         127.0.0.1:5917         TIME_WAIT       0
  TCP    127.0.0.1:9300         127.0.0.1:5918         TIME_WAIT       0

Then I found that port 9300 was occupied by the process whose PID is 6676. Then I checked the process's name by typing, and killed this process:

tasklist | findstr 6676

After I killed this, I typed the following command to check which port is still open.

netstat -a

The output is:

TCP    0.0.0.0:9300           DESKTOP-7AI5AKV:0      LISTENING

How could this be possible? I just closed this port. How could this still be listening?

port cmd networking tcp sockets
1 Answers

A service in listening mode on all ports will show in netstat as this:

0.0.0.0:9300

You can locate which process is listening to this port with this command:

% lsof | grep LISTEN
sshd        511                           root    3u     IPv4              12453      0t0        TCP *:ssh (LISTEN)

For example, my sshd is currently pid = 511.

Killing the server PID will have the server restarted by the init system (e.g. systemd on Linux or launch services on macOS). You can encourage the server to restart by doing kill -15 511 for PID 511. You can also try -9 if it does not restart.

The ESTABLISHED and TIME_WAIT are active connections and closed pending 2 minute expire timer clearing.

James Risner0
Related