Re: Strange sockstat entries

Doug Hardie <[email protected]> writes:
> I am seeing a number of unusual sockstat entries that look like:
>
> ??       ??            ??    ?? tcp4    10.0.1.230:587        178.16.54.22:63001
>
> The occur at the end of the output.  Often there are about 10 or so
> entries.  Most of them vanish after a few seconds.  However, two are
> quite persistent.  What causes this type of entry?

sockstat works by retrieving and cross-referencing information from two
separate lists, one that ties sockets to processes and another that ties
sockets to connections.  If a socket is opened or closed while sockstat
is working, it may show up in one list but not in the other.  It might
be better to drop incomplete entries by default.

Note that sockets owned by the kernel (e.g. NFS) will never show up in
the list of processes.  Perhaps we should arrange things so they show up
with PID and UID 0.

DES
-- 
Dag-Erling Smørgrav - [email protected]