I'm trying to implement code that enumerate all existing TCP connections per process (similar to netstat -lptn
).
I prefer to implement it myself and not to rely on netstat
.
In order to do that, I'm parsing data from /proc/<PID>/net/tcp
.
I saw that a number of TCP connections are listed under /proc/<PID>/net/tcp
but not listed by netstat -lptn
command.
For example I see that /proc/1/net/tcp
and /proc/2/net/tcp
have several TCP connections (tried on Ubuntu 16).
As I understand, /proc/1/net/tcp
is related to the /sbin/init
process which should not have any TCP connection.
The /proc/2/net/tcp
is related to kthreadd
which also should not have any TCP connection.
Best Answer
There are many misunderstandings in your approach. I'll go over them one by one.
dup2
,fork
, and file descriptor passing it's possible to create many references to the same socket causing its reference count to increase. Some of these references can be from an open file descriptor table, which itself can be used by many threads. Those threads may belong to the same thread group (PID) or different thread groups. When you use the-p
flag fornetstat
it will enumerate the sockets accessible to each process and try to find a process for each known socket. If there are multiple candidate processes, there is no guarantee that it shows the process you are interested in./proc/<PID>/net/tcp
does not only list sockets related to that process. It lists all TCPv4 sockets in the network namespace which that process belongs to. In the default configuration all processes on the system will belong to a single network namespace, so you'll see the same result with any PID. This also explains why a thread/process which doesn't use networking has contents in this file. Even if it doesn't use networking itself it still belongs to a network namespace in which other processes may use networking./proc/<PID>/net/tcp
contains both listening and connected sockets. When you pass-l
tonetstat
it will show you only listening sockets. To match the output closer you'd need-a
rather than-l
./proc/<PID>/net/tcp
contains only TCPv4 sockets. You need to use/proc/<PID>/net/tcp6
as well to see all TCP sockets.If you are only interested in sockets in the same namespace as your own process you don't need to iterate through different PIDs. You can instead use
/proc/net/tcp
and/proc/net/tcp6
since/proc/net
is a symlink to/proc/self/net
.