Re: Strange sockstat entries

> On Feb 7, 2026, at 03:23, Dag-Erling Smørgrav <[email protected]> wrote:
> 
> Doug Hardie <[email protected]> writes:
>> I am seeing a number of unusual sockstat entries that look like:
>> 
>> ??       ??            ??    ?? tcp4    10.0.1.230:587        178.16.54.22:63001
>> 
>> The occur at the end of the output.  Often there are about 10 or so
>> entries.  Most of them vanish after a few seconds.  However, two are
>> quite persistent.  What causes this type of entry?
> 
> sockstat works by retrieving and cross-referencing information from two
> separate lists, one that ties sockets to processes and another that ties
> sockets to connections.  If a socket is opened or closed while sockstat
> is working, it may show up in one list but not in the other.  It might
> be better to drop incomplete entries by default.
> 
> Note that sockets owned by the kernel (e.g. NFS) will never show up in
> the list of processes.  Perhaps we should arrange things so they show up
> with PID and UID 0.

Thanks for the information.  That makes sense now.  I would think it would be better to not include the ?? ?? entries, but I can live with either approach now that I know what they mean.

I did find one unexpected case where sockstat shows 32K entries for blacklistd.  I find that quite unexpected as pftop only shows 26 entries for everything.  netstat shows the same 32K entries so those must be established connections.  Why are they still open when pftop doesn't show them.  I would think that would mean they were closed.  I would expect that having that many open connections would slow down the system.

-- Doug