2

If I have no permission to use lsof, how do I get them for a process with pid already known? Thanks

I know netstat -l -p command print out active unix domain sockets, but it seems it's not updating ? after I closed the socket, it still shows up in netstat command result.

  • 2
    What OS are you using? – techraf Mar 17 '16 at 22:33
  • netstat -lp shows the listening (server) sockets. If that socket has been closed on the process(es), it can't show up in there. You may prefer ss to netstat as netstat gives at most one process per socket. – Stéphane Chazelas Mar 21 '16 at 14:37
1

On Linux you can look through the /proc filesystem specifically for a given PID under /proc/<pid>/fd. All the file descriptors (fd) are listed there per process.

Example

$ ls -l /proc/27634/fd/
total 0
lrwx------ 1 root root 64 Mar 17 20:09 0 -> /dev/null
lrwx------ 1 root root 64 Mar 17 20:09 1 -> /dev/null
lrwx------ 1 root root 64 Mar 17 20:10 10 -> /dev/ptmx
lrwx------ 1 root root 64 Mar 17 20:10 12 -> /dev/ptmx
lrwx------ 1 root root 64 Mar 17 20:10 13 -> /dev/ptmx
lrwx------ 1 root root 64 Mar 17 20:09 2 -> /dev/null
lr-x------ 1 root root 64 Mar 17 20:09 3 -> socket:[430396]
l-wx------ 1 root root 64 Mar 17 20:09 4 -> socket:[430437]
lrwx------ 1 root root 64 Mar 17 20:09 5 -> pipe:[430440]
l-wx------ 1 root root 64 Mar 17 20:10 6 -> pipe:[430440]
lrwx------ 1 root root 64 Mar 17 20:10 7 -> socket:[430443]
lrwx------ 1 root root 64 Mar 17 20:10 8 -> socket:[430444]
lrwx------ 1 root root 64 Mar 17 20:10 9 -> socket:[430446]

Everything listed there as socket:[....] is a socket.

  • 2
    And to know if they're unix, tcp, udp or other sockets, you can try grep -slw 430396 /proc/net/* for instance. – Stéphane Chazelas Mar 21 '16 at 14:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.