1

What does I-Node mean in the output of netstat -ap for unix domain sockets?

It seems not the same as the inode of the socket file:

$ netstat -ap
...
Active UNIX domain sockets (servers and established)
Proto RefCnt Flags  Type   State     I-Node  PID/Program name     Path
unix  2    [ ACC ]  STREAM LISTENING 2794745 -              /tmp/emacs1001/server
...

$ sudo ls -i -l /tmp/emacs1001/server 
11796488 srwx------ 1 testme testme 0 Nov 30 19:22 /tmp/emacs1001/server

Thanks.

2
  • 1
    I don't get that column with netstat (Proto, Recv-Q, Send-Q, Local Address, Foreign Address, State, PID/Program name). But a socket can have an inode. See stackoverflow.com/questions/27659460/… – melds Dec 3 '18 at 22:21
  • @melds Thanks. Could you be specific of what the inode in netstat output and the inode shown by ls mean respectively? – Tim Dec 3 '18 at 23:45
2

The inode shown by netstat is the inode of your socket in sockfs (a virtual filesystem holding inodes for sockets in the system).

The sockfs can also be seen in /proc/<pid>/fd/ entries - socket fds will be be marked as a link to socket:[XXXX] with XXXX the inode (This way you can match socket inodes from netstat to processes owning an fd for those sockets).

And the inode of the socket file is the inode belonging to the containing filesystem; for example, /tmp/emacs1001/server is a socket filesystem node on your root ext4 filesystem (or in your /tmp filesystem, if it's a standalone mount)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.