/fd/ ? I got the impress...">
Geek Answers Handbook

How to find a TCP socket inode?

How to bind the values ​​in the "inode" /proc/net/tcp column to the files in /proc/<pid>/fd/ ?

I got the impression that the inode column in TCP has a decimal representation of the inode socket, but that doesn't seem to be the case.

For example, if I run telnet localhost 80 , I see the following (telnet - pid 9021).

/proc/net/tcp contains

 sl local_address rem_address st tx_queue rx_queue tr tm->when retrnsmt uid timeout inode 23: 0100007F:CE2A 0100007F:0050 01 00000000:00000000 00:00000000 00000000 1000 0 361556 1 00000000 20 0 0 10 -1

which makes me think that the index of the socket connected to 127.0.0.1:80 is 361556. But if I run ls --inode -alh /proc/9021/fd , I will see

 349886 lrwx------ 1 me me 64 Dec 26 10:51 3 -> socket:[361556]

The index is 349886, which is different from the value in the inode column of the tcp table: 361556. But the link target seems to have the correct name. Similarly, stat /proc/9021/3 shows:

 File: '/proc/9021/fd/3' -> 'socket:[361556]' Size: 64 Blocks: 0 IO Block: 1024 symbolic link Device: 3h/3d Inode: 349886 Links: 1

What is the number in the inode column of the tcp table? Why doesn't it match the index specified by ls or stat ?

(I use Ubuntu 14.10 if that matters)

+2
source share
2 answers

The index shown by ls and stat is for a symbolic link pointing to the index associated with the socket. Running ls -iLalh shows the correct index. The same goes for stat -L .

Herpa derp derp. I only realized this when I wrote my question .; _;

+4
source

The id is the file identifier for each mount fs (proc, sys, ntfs, ext ...), so you probably understand that you are dealing with two different fs here: procfs and some fs pseudo-sockets.

Files in the / proc / pid / fd / directories are soft links that have an inode representation in procfs fs. These links "point" to different "fs" - socket fs.

What stat -L and ls -iLalh do is give you the index of the file descriptor the link points to. You can do this also explicitly with readlink /proc/#pid/fd/#fdnum

0
source

More articles:


All Articles