Some process on my Solaris 10 machine is sending TCP SYNs to a remote machine. The remote machine never responds, so the connection is not established. How do I find out what process is initiating this?

I've been looking at DTrace scripts but a) I don't know Dtrace well enough to create my own, b) haven't found an existing script, and c) some that I have found use probes not available in my version.

Thanks for any insight. Gary

  • Does netstat -tp or similar work on Solaris? On Linux, that'd show TCP sockets (-t) and list the program that has them open (-p). That'd of course require you to run netstat when the program is actually trying. They should be in the SYN_SENT state. – derobert Nov 20 '12 at 17:42
  • @derobert -p flag has a different meaning in Solaris, and it doesn't have similar flag to replace it. – Karlson Nov 20 '12 at 19:21
  • What is your precise Solaris 10 version uname -a; cat /etc/release and what probes were missing ? – jlliagre Nov 20 '12 at 20:31

Have a look at this Dtrace script: conntrack

# ./conntrack -h
USAGE: ./conntrack [-h] [-p port] [-c command] [-u user]
   -p port         # filter by port (incompatible with user and command)
   -c command      # filter by command (incompatible with port and user)
   -u user         # filter by user (incompatible with port and command)
       ./conntrack -p 22    # snoop connections to port 22

If you know the destination IP and Port you could run:

pfiles $pid 

for every process on your system to determine which one has a socket opened with attributes. It might also be better to try using

lsof -i

as root to see if you can get the socket while it's still live.

Since the machine is external you might be able to try and see who it belongs to and what software you have from them to limit the processes you may have to look at.

  • Thanks for the pointer. I tried using [code] # for PID in /usr/bin/ps -e -o pid; do echo Checking PID $PID...; /usr/bin/pfiles $PID |grep port:; done – Gary Nov 20 '12 at 20:42
  • Ignore the comment above. Having trouble formatting and I took too long to edit. Thanks for the pointer. I tried using # for PID in /usr/bin/ps -e -o pid; do echo Checking PID $PID...; /usr/bin/pfiles $PID |grep port:; done but I think I have to be running the pfiles command on the PID at the exact same time as the TCP SYN is being sent. ? The SYN is not a constant barrage so I didn't get a hit. I do know the port (16001) and the destination. I can't verify what belongs to port 16001. Internet searches point to things but I can't find the culprit. – Gary Nov 20 '12 at 20:53
  • @Gary You're right both of these commands will only show the information while the socket is active(trying to establish connection). But Port 16001 is not what you should be looking at but the IP address or hostname. – Karlson Nov 20 '12 at 20:55

For each process on your system, pause it with kill -STOP $pid, see if the connection attempts stop, and resume it with kill -CONT $pid.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.