How to close or (unbind?) a port left open by a rogue application?

Solution 1:

The only way to forcefully close a listening port is to kill the process that is listening on it. Use lsof, netstat, fuser – as root – to find out the process ID. Once the process exits (by itself or by being killed), the kernel will automatically clean up all sockets it had open. (However, there might be cases that programs will be denied listening on the same port for a few minutes; in this case all you can do is wait.)

Solution 2:

lsof -n -i

Find the process you're looking for and kill it.

From lsof manual:

-n This option inhibits the conversion of network numbers to host names for network files. Inhibiting conversion may make lsof run faster. It is also useful when host name lookup is not working properly.

-i [i] This option selects the listing of files any of whose Internet address matches the address specified in i. If no address is specified, this option selects the listing of all Internet and x.25 (HP-UX) network files.

Same answer to this question I think.

Solution 3:

You can user the fuser command with the -k switch.

For example, to close port 111, you can do the following: fuser -k 111/tcp (this also saves you the hassle of find the ID of the process to kill it as fuser does in implicitly)

Note that some processes restart automatically once closed. For that, you need to check each process's config file to come up with an appropriate workaround.