When you view the
/proc/net/tcp or the
/proc/net/tcp6 files you are able to see the open ports on the machine itself.
But just wondering in what order are these entries being listed in?
As described in this kernel documentation file,, the actual code that produces the listing is in Linux kernel source file .../net/ipv4/tcp_ipv4.c. The documentation file says that any listening sockets are listed first, then the established connections.
No further sorting of any kind is promised. So the exact ordering (or non-ordering) might change if/when the storage of TCP socket states within the kernel is reimplemented, or in other words, different kernel versions might do things very differently.
There seems to be four main functions related to
tcp4_seq_start()starts an iterator for traversing the kernel TCP data structures
tcp4_seq_show()translates the current record into a line of text, using various sub-functions
tcp4_seq_next()finds the next data record
tcp4_seq_stop()cleans up the iterator when the file is closed or the listing is complete.
The kernel data structures from which the listing is generated are the actual data structures used for handling the respective TCP connections, so in a certain sense you might say that the act of a process running a
connect() system call causes an entry to be inserted. There is no separate "update /proc/net/tcp" step anywhere.