Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I sometimes come upon machine with tap interfaces (eg, when KVM is running). How can I know which process is attached to the TAP interface?

share|improve this question
I suspect you can do this with nmap, but I'm not sure how to be honest. – Alex Chamberlain Jun 12 '12 at 6:45
up vote 1 down vote accepted

This got me wondering and I had a look at the Linux kernel source (I'm assuming your question is about Linux).

It appears the answer's more difficult than you'd expect. This TUN/TAP API tutorial page offers some insight. Basically, your program allocates a new TUN/TAP device by opening /dev/net/tun and sending it the TUNSETIFF ioctl. If all goes well, an interface is created, the kernel gives you its name and a file descriptor, and that's how you manage it.

There are two catches here:

  1. The kernel doesn't store the PID of the process that sent the ioctl in struct tun_struct (TUN and TAP largely share the same data structures).
  2. A process may mark an interface as persistent, close its file descriptor and thereafter use it as a normal network interface.

In practice, I suspect 2 doesn't happen much. Checking out an openvpn process with lsof reveals it's still got its file descriptor to the TAP device open and obviously using it, but since /dev/net/tun is a sort of multiplexing device like /dev/ptmx, you can use lsof to find out what processes are currently using a TUN/TAP device, but you can't know what process is using what device.

There are oblique ways of solving the underlying problem. For OpenVPN, I use a tunnel setup script that names the tunX/tapX devices with a more descriptive name that includes the basename of the OpenVPN config file. So, /etc/openvpn/foo.conf leads to a vpn-foo device. Then I can correlate the OpenvVPN process with the interface it's using. Haven't had to do this with QEmu/KVM yet, though.

share|improve this answer
Ok. I was suspecting too that the "multiplexing" /dev/net/tun would prevent us to know what tap interface exactly a process is attached too. – user368507 Jun 17 '12 at 15:38
ifconfig tap0

should show you which process is connected to the interface.

share|improve this answer
What OS and version are you trying this on? It'd be VERY handy to have this information (I run a box with dozens of VPN endpoints), but the Debian ifconfig doesn't show this. Mind you, these are tap devices created by OpenVPN — though I don't see why there should be a difference. – Alexios Jun 16 '12 at 11:17
This is about FreeBSD or any other BSD derivative. – kworr Feb 26 '15 at 15:19

Each file descriptor has a /proc/pid/fdinfo/num entry, like:

# cat /proc/24332/fdinfo/28
pos:    0
flags:  0104002
mnt_id: 18
iff:    tap0123acdc-66

So, with the interface name, you can get the pid with:

# egrep -l iff:.*tap0123acdc-66 /proc/*/fdinfo/* 2>/dev/null|cut -d/ -f3
share|improve this answer
Works for me: % sudo bash -c 'grep -l iff:.*vnet0 /proc/*/fdinfo/* 2>/dev/null | cut -d/ -f3' 4143 % pgrep qemu 4143 Given the fact that there is a name parameter shown in the output of ps -ef for qemu processes, e.g. qemu-system-x86_64 -enable-kvm -name debian-8 it should be easy to find out to which VM a pid and an interface corresponds to. – Dmitrii S. May 10 at 19:34

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.