QUESTION:
My customer is developing TCP/IP sockets applications and
has a requirement to know the process id of the processes
that have a specific socket open. I can find no command
that displays the pids listening on a socket.
My suspicion is that there is no command to do what the customer
would like and that he may have to chase control blocks in
/dev/kmem. Can you confirm that there is no command to display
the pid of an open socket and suggest the chains of control
blocks to follow to retrieve the desired information?
---------- ---------- ---------- --------- ---------- ----------
A: You are correct, there is not a command that will allow
a direct correlation between a process id and the
process utilizing a specific socket. The only method that
I am aware of is as follows:
------------------------------------------------------------
The following steps outline this procedure:
1) run crash
> proc
find the process you want
62 s 3e6d 3922 3e6d 3918 3918 60 0 001fec7c sock
FLAGS: swapped_in trace wake/sig
2) Dump the user area of the process
> u 62
FILE DESCRIPTOR TABLE
*ufd: 0x200bc044
fd 0:fp = 0x002164c8 flags = 0x00000000 inode.VMPC = 0x05bc4080
fd 1:fp = 0x002164c8 flags = 0x00000000 inode.VMPC = 0x05bc4080
fd 2:fp = 0x002164c8 flags = 0x00000000 inode.VMPC = 0x05bc4080
fd 3:fp = 0x002164c8 flags = 0x00000000 inode.VMPC = 0x05bc4080
fd 4:fp = 0x002162c8 flags = 0x00000000 inode.VFIFO = 0x05bba180
fd 5:fp = 0x00216aa8 flags = 0x00000000 socket.STREAM = 0x0553d714
3) It is probably easiest at this point to run pstat -f (dumps the file
table) in another window. Grep for the "fp" (file pointer) value
you are interested in, i.e.
fd 5:fp = 0x00216aa8 flags = 0x00000000 socket.STREAM = 0x0553d714
pstat -f | grep 216aa8
341 0x00216aa8 1 socket.STREAM 0x0553d714 read write
4) Now "341" is the slot in the file table for this socket.
5) Use the "ndb" subcommand of crash
> ndb
6. use ndb to dump the info for the socket living at slot# we found
above
ndb> sockets 341
----------------- SOCKET INFO-------------------
type:0x0001 (STREAM) opts:0x0002 (ACCEPTCONN)
state:0x0000 ()
linger:0x0000 pcb:0x0553d314 proto:0x01477a50
q0:0x00000000 q0len: 0 q:0x00000000
qlen: 0 qlimit: 5 head:0x00000000
timeo: 0 error: 0 oobmark: 0 pgid: 0
snd: cc: 0 hiwat:16384 mbcnt: 0 mbmax:65536
lowat: 1 mb:0x00000000 events:0x 0
iodone:0x00000000 ioargs:0x00000000 flags:0x0000 ()
rcv: cc: 0 hiwat:16384 mbcnt: 0 mbmax:65536
lowat: 1 mb:0x00000000 events:0x 0
iodone:0x00000000 ioargs:0x00000000 flags:0x0000 ()
ndb.sock> q
7. use ndb to dump the protocol block the socket is referencing,
use
a. "tcb" for TCP sockets
b. "udb" for UDP sockets
ndb> tcb 0553d314
TCB-HEAD----------- INPCB INFO -------------------
next:0x05535a14 prev:0x0148b3b8 head:0x0148b3b8
ppcb:0x0553dd14 inp_socket:0x0553d714
lport: 9999 laddr:0x00000000 (NONE) <== local address & port
fport: 0 faddr:0x00000000 (NONE) <== foreign address & port
----------------- SOCKET INFO-------------------
type:0x0001 (STREAM) opts:0x0002 (ACCEPTCONN)
state:0x0000 ()
linger:0x0000 pcb:0x0553d314 proto:0x01477a50
q0:0x00000000 q0len: 0 q:0x00000000
qlen: 0 qlimit: 5 head:0x00000000
timeo: 0 error: 0 oobmark: 0 pgid: 0
snd: cc: 0 hiwat:16384 mbcnt: 0 mbmax:65536
lowat: 1 mb:0x00000000 events:0x 0
iodone:0x00000000 ioargs:0x00000000 flags:0x0000 ()
rcv: cc: 0 hiwat:16384 mbcnt: 0 mbmax:65536
lowat: 1 mb:0x00000000 events:0x 0
iodone:0x00000000 ioargs:0x00000000 flags:0x0000 ()
So, in this example, this is a TCP socket, it's state is
ACCEPTCONN (it is sleeping, waiting for a connection, i.e.
it called accept() ), it's local port number is 9999, there
is no foreign port number yet since this process is sleeping
waiting for a connection.
---------------------------------------------------------------
I do not know the control blocks that you would need to
look at in the kernel. I have looked through all of my
programming guides, and could not find a single kernel
control block having reference to tcp/ip or udp
sockets in relation to a process id.
---------- ---------- ---------- --------- ---------- ----------
This item was created from library item Q675810 FFDMQ
Additional search words:
COMMUNICATIO DISPLAY DSPLY FFDMQ IX JAN95 OPEN OPENED OZNEW PID
PROCESS PROCESSING PROCESSOR RISCSYSTEM RISCTCP SOCKET SOFTWARE
SPECIFIC TCPIP
WWQA: ITEM: RTA000052182 ITEM: RTA000052182
Dated: 04/1996 Category: RISCTCP
This HTML file was generated 99/06/24~12:43:20
Comments or suggestions?
Contact us