I'm trying to find a way to safely shutdown a network interface, i.e. without disturbing any processes. For this I need to find out what processes are currently using that interface. Tools like ss
, netstat
or lsof
are helpful showing which processes have open sockets, but they don't show wpa_supplicant
, dhcpcd
, hostapd
and others.
Is there a way to detect these processes in a general way? It might not for dhcpcd, as it is just a program opening a socket every now and then, but I'm assuming wpa_supplicant and hostapd would “do something” to that interface which is detectable and perhaps also leads to the relevant PID.
Best Answer
Such programs will be using Netlink sockets to talk to the network hardware's driver directly.
lsof
version 4.85 added support for Netlink sockets, but in my testing on CentOS 5.8, the feature doesn't appear to work very well. Perhaps it depends on features added in newer kernels.However, it is possible to make a pretty good guess about when you've run into a Netlink socket. If you
cat /proc/net/netlink
you get a list of open Netlink sockets, including the PID of processes that have them opened. Then if youlsof -p $THEPID
those PIDs, you'll find entries withsock
in theTYPE
column andcan't identify protocol
in theNAME
column. It's not guaranteed that these are Netlink sockets, but it's a pretty good bet.You might also infer that a given process is talking directly to an interface if it has files under
/sys/class/net/$IFNAME
open.Now, all that having been said, I think your question is wrong-headed.
Let's say there is a command I haven't discovered. Call it
lsif -i wlan0
, and say it returns a list of PIDs accessing the named interface. What would you be able to do with it which would allow you to "not disturb" processes using that interface, as you've requested? Were you planning on killing off all the processes using that interface first? That's pretty disturbing. :) Maybe you were instead thinking that dropping the interface out from underneath a process using it would somehow be harmful?What, in the end, is so bad about
ifconfig wlan0 down
?Network interfaces are not storage devices. You don't have to flush data to disk and unmount them gracefully. Not breaking open sockets might be worthwhile, but as you already know, you can figure that out with
netstat
andlsof
.wpa_supplicant
isn't going to sulk if you bounce its interface unceremoniously. (If it does, it's a bug and needs to be fixed; it wouldn't indicate some fault of yours.)Well-written network programs cope with such things as a matter of course. Networks are unreliable. If a program can't cope with an interface being bounced, it also won't be able to cope with unplugged Ethernet cables, balky DSL modems, or backhoes.