Further down in the
netstatoutput is UNIX sockets:
Active UNIX domain sockets (servers and established) Proto RefCnt Flags Type State I-Node PID/Program name Path <snip> unix 2 [ ACC ] STREAM LISTENING 21936 1/systemd /run/dbus/system_bus_socket <snip> unix 3 [ ] STREAM CONNECTED 28918 648/dbus-daemon /run/dbus/system_bus_socket
We can see that both of these processes are using the UNIX socket at
/run/dbus/system_bus_socket. So if you knew one of the processes, looking at this, you should be able to determine the other end.
Does that mean any pair of server and client processes based on Unix domain socket should appear in the output of
netstat like the one above? In other words, should
netstat always show both server and client processes?
GNU Screen also runs as server and client processes based on Unix domain socket, so should they appear in the output of
netstat? Why does
netstat in fact not show Screen client but only Screen server process like the one below,
$ sudo netstat -ap | grep -i screen unix 2 [ ACC ] STREAM LISTENING 4533106 27525/SCREEN /run/screen/S-t/27525.test
ps shows both?
$ ps aux | grep -i screen t 19686 0.0 0.0 45096 3292 pts/7 S+ 22:19 0:00 screen -r test t 27525 0.0 0.0 45780 3292 ? Ss 07:22 0:00 SCREEN -S test