Connections in /proc/[pid]/net/tcp which don't appear in /proc/net/tcp

Question

I'm implementing code to fetch all network connections and associate them with the PIDs using them.

Say, for tcp4, for each pid, I'm listing /proc/pid/fd, searching there for links to sockets, reading their inode numbers and looking them up in /proc/net/tcp to get the details about the connection.

However, if I look up the inode numbers in /proc/net/tcp I get less connections than if I look them up in /proc/[pid]/net/tcp. For example, if I'm doing the above process while relying on /proc/net/tcp, I can only see sockets opened by my browser, while if I'm relying on /proc/[pid]/net/tcp, I can see that my broswer and the 'java' process have open connections.

So should I rely on /proc/net/tcp or /proc/[pid]/net/tcp for this purpose? I'm confused because psutil, which is a widely-used package in Python is using /proc/net/tcp on the one hand, but it seems like some connections are missing if I don't look at /proc/[pid]/net/tcp.

Answer 1

/proc/net is a symbolic link to /proc/self/net, so /proc/net and /proc/[pid]/net are different only when process [pid] and the process which examines /proc/net are in different network namespaces.

If you want to list all the sockets, you'll have to look through all the namespaces; for two processes which are in the same network namespace, their /proc/PID/ns/net will have the same inode number. That way you can enumerate all the different network namespaces on your system.