I found a Unix socket being used in the output of the lsof command:

COMMAND    PID  TID TASKCMD               USER   FD      TYPE             DEVICE  SIZE/OFF       NODE NAME
screen    110970         username    4u     unix 0xffff91fe3134c400       0t0   19075659 socket

The "DEVICE" column holds what looks like a memory address. According to the lsof man page:

DEVICE     contains the device numbers, separated by commas, for a character special, block special, regular, directory or NFS file;

                  or ``memory'' for a memory file system node under Tru64 UNIX;

                  or the address of the private data area of a Solaris socket stream;

                  or a kernel reference address that identifies the file (The kernel reference address may be used for FIFO's, for example.);

                  or the base address or device name of a Linux AX.25 socket device.

                  Usually only the lower thirty two bits of Tru64 UNIX kernel addresses are displayed.

My question is, which of these am I looking at with the value 0xffff91fe3134c400?

Also, how can I interact with it? I know I can use netcat to connect to a Unix domain socket, but from reading examples online it looks like you have to specify a file.


1 Answer 1


I do not know how to answer your first second question, but regarding the first one, you can use the +E flag for lsof to show the endpoint of the socket. From the man pages:

+|-E +E specifies that Linux pipe, Linux UNIX socket and Linux pseudoterminal files should be displayed with endpoint information and the files of the endpoints should also be displayed

For instance, here's some example from a question someone had where he was trying to find out the endpoint of fd 6 of a top process:

# lsof -d 6 -U -a +E -p $(pgrep top)
dbus-daem   874 messagebus   12u  unix 0xffff9545f6fee400      0t0 366381191 /var/run/dbus/system_bus_socket type=STREAM ->INO=366379599 25127,top,6u
top       25127       root    6u  unix 0xffff9545f6fefc00      0t0 366379599 type=STREAM ->INO=366381191 874,dbus-daem,12u

The -U flag for lsof shows only Unix socket files.

Notice that you will only see the name of the socket file for the listening processes. The other process will not show the name of the unix socket file, but with +E lsof will show the inode of the listening socket file, and will also add a line for the process listening to this socket (along with the socket file name).

In this example notice that we only asked lsof to show the file descriptors of top command, but lsof added another line for dbus-daem - which is the listening process, and the socket file it listens to is /var/run/dbus/system_bus_socket.

  • Pid 25127 (inode 366379599) interacts with inode 366381191 (type=STREAM ->INO=366381191 874,dbus-daem,12u)
  • Inode 366381191 belong to pid 874, and you can see this process has the fd that is the listening side for the second process (/var/run/dbus/system_bus_socket type=STREAM ->INO=366379599 25127,top,6u), and there you can see that the socket file name is /var/run/dbus/system_bus_socket.
  • is the ->INO=366381191 an inode? some show the file path but others only show the INO number Jan 27 at 16:46
  • @dcom-launch, I have edited my answer, I hope my clarification helps.
    – aviro
    Jan 27 at 18:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.