Date: Fri, 14 May 2010 15:39:03 +0300 From: Mikolaj Golub <to.my.trociny@gmail.com> To: Julian Elischer <julian@elischer.org> Cc: freebsd-net@freebsd.org, Mike Tancsa <mike@sentex.net>, Wes Peters <barnaclewes@gmail.com> Subject: Re: sockstat / netstat output 8.x vs 7.x Message-ID: <86pr0yiro8.fsf@zhuzha.ua1> In-Reply-To: <4BE9BCE2.7070303@elischer.org> (Julian Elischer's message of "Tue, 11 May 2010 13:24:02 -0700") References: <201005111814.o4BIEPfN071211@lava.sentex.ca> <AANLkTinEjLEbGv_TIDWTz_rDxc4S_EDr_mCMmd0cINzl@mail.gmail.com> <4BE9BCE2.7070303@elischer.org>
next in thread | previous in thread | raw e-mail | index | archive | help
On Tue, 11 May 2010 13:24:02 -0700 Julian Elischer wrote: JE> On 5/11/10 12:20 PM, Wes Peters wrote: >> The output header is instructive: >> >> USER COMMAND PID FD PROTO LOCAL ADDRESS FOREIGN ADDRESS >> www httpd 18423 3 tcp4 6 *:80 *:* >> www httpd 18423 4 tcp4 *:* *:* >> www httpd 25184 3 tcp4 6 *:80 *:* >> www httpd 25184 4 tcp4 *:* *:* >> >> Same as 7, it's the foreign address. This is normally only useful for >> connected sockets. >> >> On Tue, May 11, 2010 at 11:14 AM, Mike Tancsa<mike@sentex.net> wrote: >>> [trying on freebsd-net since no response on stable] >>> >>> I noticed that apache on RELENG_8 and RELENG_7 shows up with output I cant >>> seem to understand from sockstat -l and netstat -naW >>> >>> On RELENG_7, sockstat -l makes sense to me >>> .... >>> www httpd 83005 4 tcp4 *:443 *:* >>> www httpd 82217 3 tcp4 *:80 *:* >>> www httpd 82217 4 tcp4 *:443 *:* >>> www httpd 38942 3 tcp4 *:80 *:* >>> www httpd 38942 4 tcp4 *:443 *:* >>> root httpd 1169 3 tcp4 *:80 *:* >>> root httpd 1169 4 tcp4 *:443 *:* >>> >>> >>> various processes listening on all bound IP addresses on ports 80 and 443. >>> >>> On RELENG_8 however, it shows up with an extra entry (at the end) >>> >>> www httpd 29005 4 tcp4 *:* *:* >>> www httpd 29004 3 tcp4 6 *:80 *:* >>> www httpd 29004 4 tcp4 *:* *:* >>> www httpd 29003 3 tcp4 6 *:80 *:* >>> www httpd 29003 4 tcp4 *:* *:* >>> www httpd 66731 3 tcp4 6 *:80 *:* >>> www httpd 66731 4 tcp4 *:* *:* >>> root httpd 72197 3 tcp4 6 *:80 *:* >>> root httpd 72197 4 tcp4 *:* *:* >>> >>> >>> *:80 makes sense to me... process is listening on all IPs for port 80. What >>> does *:* mean then ? JE> I believe it has created a socket but not used it for anything JE> it may be the 6 socket... otherwise I don't see what a "tcp4 6" is JE> meant to be. Comparing RELENG_8 and RELENG_7 outputs it might be for https, which looks like is not configured on RELENG_8 host. I think socket() was called but no any other actions with the socket was performed. >>> >>> Netstat gives a slightly different version of it >>> >>> Active Internet connections (including servers) >>> Proto Recv-Q Send-Q Local Address Foreign Address (state) >>> tcp4 0 0 *.1984 *.* LISTEN >>> tcp4 0 0 *.* *.* CLOSED >>> tcp46 0 0 *.80 *.* LISTEN >>> >>> state closed ? You can reproduce this with this simple program: zhuzha:~/src/test_socket% cat test.c #include <sys/types.h> #include <sys/socket.h> #include <errno.h> #include <unistd.h> #include <err.h> int main(int argc, char **argv) { int sockfd; if ((sockfd = socket(AF_INET, SOCK_STREAM, 0)) < 0) errx(1, "socket error"); sleep(60); return 0; } zhuzha:~/src/test_socket% make cc -g -O0 -Wall test.c -o test zhuzha:~/src/test_socket% ./test& [1] 56076 zhuzha:~/src/test_socket% sockstat|grep test golub test 56076 3 tcp4 *:* *:* zhuzha:~/src/test_socket% netstat -na |grep CLOSED tcp4 0 0 *.* *.* CLOSED -- Mikolaj Golub
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?86pr0yiro8.fsf>