Interacting with Unix Socket found in lsof

Question

I found a Unix socket being used in the output of the lsof command:

COMMAND    PID  TID TASKCMD               USER   FD      TYPE             DEVICE  SIZE/OFF       NODE NAME
screen    110970         username    4u     unix 0xffff91fe3134c400       0t0   19075659 socket

The "DEVICE" column holds what looks like a memory address. According to the lsof man page:

DEVICE     contains the device numbers, separated by commas, for a character special, block special, regular, directory or NFS file;

                  or ``memory'' for a memory file system node under Tru64 UNIX;

                  or the address of the private data area of a Solaris socket stream;

                  or a kernel reference address that identifies the file (The kernel reference address may be used for FIFO's, for example.);

                  or the base address or device name of a Linux AX.25 socket device.

                  Usually only the lower thirty two bits of Tru64 UNIX kernel addresses are displayed.

My question is, which of these am I looking at with the value 0xffff91fe3134c400?

Also, how can I interact with it? I know I can use netcat to connect to a Unix domain socket, but from reading examples online it looks like you have to specify a file.

Answer 1

To find the file associated with the UNIX socket, you can use the +E flag for lsof to show the endpoint of the socket. From the man pages:

+|-E +E specifies that Linux pipe, Linux UNIX socket and Linux pseudoterminal files should be displayed with endpoint information and the files of the endpoints should also be displayed

For instance, here's some example from a question someone had where he was trying to find out the endpoint of fd 6 of a top process:

# lsof -d 6 -U -a +E -p $(pgrep top)
COMMAND     PID       USER   FD   TYPE             DEVICE SIZE/OFF      NODE NAME
dbus-daem   874 messagebus   12u  unix 0xffff9545f6fee400      0t0 366381191 /var/run/dbus/system_bus_socket type=STREAM ->INO=366379599 25127,top,6u
top       25127       root    6u  unix 0xffff9545f6fefc00      0t0 366379599 type=STREAM ->INO=366381191 874,dbus-daem,12u

The -U flag for lsof shows only Unix socket files.

Notice that you will only see the name of the socket file for the listening processes. The other process will not show the name of the unix socket file, but with +E lsof will show the inode of the listening socket file, and will also add a line for the process listening to this socket (along with the socket file name).

In this example notice that we only asked lsof to show the file descriptors of top command, but lsof added another line for dbus-daem - which is the listening process, and the socket file it listens to is /var/run/dbus/system_bus_socket.

• Pid 25127 (inode 366379599) interacts with inode 366381191 (type=STREAM ->INO=366381191 874,dbus-daem,12u)
• Inode 366381191 belong to pid 874, and you can see this process has the fd that is the listening side for the second process (/var/run/dbus/system_bus_socket type=STREAM ->INO=366379599 25127,top,6u), and there you can see that the socket file name is /var/run/dbus/system_bus_socket.

Also, how can I interact with it?

Now that you have the filename of the UNIX socket, you can interact with it in various ways, such as:

socat - UNIX-CONNECT:/run/dbus/system_bus_socket
nc -U /run/dbus/system_bus_socket

For additional information: How can I communicate with a Unix domain socket via the shell on Debian Squeeze?