1

I'm implementing code to fetch all network connections and associate them with the PIDs using them.

Say, for tcp4, for each pid, I'm listing /proc/pid/fd, searching there for links to sockets, reading their inode numbers and looking them up in /proc/net/tcp to get the details about the connection.

However, if I look up the inode numbers in /proc/net/tcp I get less connections than if I look them up in /proc/[pid]/net/tcp. For example, if I'm doing the above process while relying on /proc/net/tcp, I can only see sockets opened by my browser, while if I'm relying on /proc/[pid]/net/tcp, I can see that my broswer and the 'java' process have open connections.

So should I rely on /proc/net/tcp or /proc/[pid]/net/tcp for this purpose? I'm confused because psutil, which is a widely-used package in Python is using /proc/net/tcp on the one hand, but it seems like some connections are missing if I don't look at /proc/[pid]/net/tcp.

1 Answer 1

1

/proc/net is a symbolic link to /proc/self/net, so /proc/net and /proc/[pid]/net are different only when process [pid] and the process which examines /proc/net are in different network namespaces.

If you want to list all the sockets, you'll have to look through all the namespaces; for two processes which are in the same network namespace, their /proc/PID/ns/net will have the same inode number. That way you can enumerate all the different network namespaces on your system.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.