Linux – Timestamp of Socket in /proc//fd

The code that generates this file is in the unix_seq_show() function in net/unix/af_unix.c in the kernel source. Looking at include/net/af_unix.h is also helpful, to see the data structures in use.

The socket path is always the last column in the output, and the Android kernel source matches the stock kernel in this respect. So unless I'm mistaken, that number that looks like a column isn't actually a separate column.

You can name UNIX domain sockets practically anything you want, as long as the total path length is less than 108 bytes. So you can't make any assumptions as to what these paths will look like. It's possible that the userspace code that's choosing those names is using a tab character followed by a number, or even padding the name out to a certain length with spaces. To test my theory, you might try looking at the socket files in /dev/socket/qmux_radio/.

This is down to a Linux:

When a program starts another, it should use the name of the executable file as command line parameter $0, but it may choose to do otherwise. The Name field of /proc/PID/status is always set to the name of the executable by the kernel (but truncated to 15 characters).

The application itself can change a name. You can get the longer name from /proc/PID/cmdline (read up to the first null byte).