Linux 3.7.10 listens on UDP port 8472 but no PID shown by netstat : # netstat -nlp | awk '{if ($NF == "-")print $0}' udp 15872 0 0.0.0.0:8472 0.0.0.0:* - # netstat -tlnpu Connexions Internet actives (seulement serveurs) Proto Recv-Q Send-Q Adresse locale Adresse distante Etat PID/Program name tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 12279/sshd tcp6 0 0 :::25 :::* LISTEN 29701/master tcp6 0 0 :::443 :::* LISTEN 11660/apache2 tcp6 0 0 :::80 :::* LISTEN 11660/apache2 udp 0 0 127.0.0.1:53 0.0.0.0:* 11448/named udp 15872 0 0.0.0.0:8472 0.0.0.0:* - lsof doesn't show anything: # lsof -i :8472 # # lsof -i :22 COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME sshd 12279 root 3u IPv4 10718 0t0 TCP *:ssh (LISTEN) sshd 12279 root 4u IPv6 10720 0t0 TCP *:ssh (LISTEN) nor does fuser: # fuser -n udp 8472 # # fuser -n tcp 22 22/tcp: 12279 12311 12314 See here: http://serverfault.com/a/51997/46213 : kernel threads might now show up. What is this port? # grep 8472 /etc/services : no results # grep 8472 nmap-services otv 8472/tcp 0.000076 # Overlay Transport Virtualization (OTV) Mmmh. OTV. Sounds like networking. 10s of google-fu later I find this: http://openvswitch.org/pipermail/dev/2012-November/023461.html Great, some progress. OTV -> Openvswitch -> VXLAN -> idea : # grep VXLAN /boot/config-`uname -r` CONFIG_VXLAN=y Ok so the kernel is listening because of this. Gotcha.