Why do I have entries at the end of sockstat not associated to any service?

[M.E.]

While debugging a jail configuration I have noticed the existence of 4 "services" that I can not manage to identify, namely the last 4 lines in this listing:

# sockstat -4 -l
USER     COMMAND    PID   FD  PROTO  LOCAL ADDRESS         FOREIGN ADDRESS      
root     sshd        2363 3   tcp4   *:22       *:*
root     nfsd        2334 5   tcp4   *:2049                *:*
root     mountd      2318 9   udp4   *:773                 *:*
root     mountd      2318 10  tcp4   *:773                 *:*
daemon   rwhod       2282 4   udp4   *:513                 *:*
daemon   rwhod       2280 4   udp4   *:513                 *:*
root     rpc.statd   2250 6   udp4   *:713                 *:*
root     rpc.statd   2250 7   tcp4   *:713                 *:*
root     rpcbind     2248 9   udp4   *:111                 *:*
root     rpcbind     2248 10  udp4   *:739                 *:*
root     rpcbind     2248 11  tcp4   *:111                 *:*
root     syslogd     2208 7   udp4   *:514                 *:*
?        ?          ?     ?   udp4   *:*                   *:*
?        ?          ?     ?   udp4   *:1015                *:*
?        ?          ?     ?   tcp4   *:994                 *:*
?        ?          ?     ?   udp4   *:2049                *:*

I identify all others with existing configured services (NFS, RWHO, SSH and SYSLOG).

Why do I see those four lines at the bottom of sockstat?

 

[dark.initr0]

It seems to me that sockstat was enable to determine local service.
Try to scan with nmap to get more information

nmap -sV -sT -sU -p- server

It could take long time (you can try to run TCP and UDP separately with concrete ports)