lkml.org 
[lkml]   [2006]   [Apr]   [22]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: unix socket connection tracking
    >>>>> I feel dumb as never so please enlight me. Is ther a way to find out which
    >>>>> process is on the other end of a unix socket pointed by a specified fd in a process.
    >>>> getpeer*()
    >>> getpeername(2) (that is the only man page I've got)
    >>>
    >> Exactly. And if you do the same on another socket from another process, you
    >> can match up what sockets are connected.
    >> You always need to examine more than one process. (Unless the process talks
    >> to itself.)
    >
    >But how can I examine a file-descriptor (socket) from within other process. Like
    >this.
    >
    >A [fd:4]------[fd:6] B -+
    >| |
    >`---[ptrace] C [ptrace]-'
    >

    7315 pts/9 S+ 0:00 | \_ ssh jengelh@lo
    3698 ? Ss 0:00 /usr/sbin/sshd -o PidFile=/var/run/sshd.init.pid
    7316 ? Ss 0:00 \_ sshd: jengelh [priv]
    7320 ? S 0:00 \_ sshd: jengelh@pts/10
    7321 pts/10 Ss 0:00 \_ -bash

    Just look at all processes and logically connect them:

    15:32 shanghai:/D/home/jengelh # l /proc/7315/fd
    total 7
    dr-x------ 2 root root 0 Apr 22 15:32 .
    dr-xr-xr-x 5 root root 0 Apr 22 15:32 ..
    lrwx------ 1 root root 64 Apr 22 15:32 0 -> /dev/pts/9
    lrwx------ 1 root root 64 Apr 22 15:32 1 -> /dev/pts/9
    lrwx------ 1 root root 64 Apr 22 15:32 2 -> /dev/pts/9
    lrwx------ 1 root root 64 Apr 22 15:32 3 -> socket:[85928]
    lrwx------ 1 root root 64 Apr 22 15:32 4 -> /dev/pts/9
    lrwx------ 1 root root 64 Apr 22 15:32 5 -> /dev/pts/9
    lrwx------ 1 root root 64 Apr 22 15:32 6 -> /dev/pts/9

    15:33 shanghai:/D/home/jengelh # l /proc/7316/fd/
    total 6
    dr-x------ 2 root root 0 Apr 22 15:32 .
    dr-xr-xr-x 5 root root 0 Apr 22 15:32 ..
    lrwx------ 1 root root 64 Apr 22 15:32 0 -> /dev/null
    lrwx------ 1 root root 64 Apr 22 15:33 1 -> /dev/null
    lrwx------ 1 root root 64 Apr 22 15:33 2 -> /dev/null
    lrwx------ 1 root root 64 Apr 22 15:33 3 -> socket:[85929]
    lrwx------ 1 root root 64 Apr 22 15:33 4 -> /dev/ptmx
    lrwx------ 1 root root 64 Apr 22 15:33 5 -> socket:[85959]

    No need for ptrace. No need for getpeername() either, but it's useful to
    get the real addresses of sockets.


    Jan Engelhardt
    --
    -
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.kernel.org
    More majordomo info at http://vger.kernel.org/majordomo-info.html
    Please read the FAQ at http://www.tux.org/lkml/

    \
     
     \ /
      Last update: 2006-04-22 21:55    [W:9.629 / U:0.204 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site