From owner-freebsd-net@FreeBSD.ORG Fri May 14 12:39:08 2010 Return-Path: Delivered-To: freebsd-net@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 036D2106566C for ; Fri, 14 May 2010 12:39:08 +0000 (UTC) (envelope-from to.my.trociny@gmail.com) Received: from fg-out-1718.google.com (fg-out-1718.google.com [72.14.220.154]) by mx1.freebsd.org (Postfix) with ESMTP id 827AE8FC16 for ; Fri, 14 May 2010 12:39:07 +0000 (UTC) Received: by fg-out-1718.google.com with SMTP id l26so1244084fgb.13 for ; Fri, 14 May 2010 05:39:06 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:from:to:cc:subject :organization:references:date:in-reply-to:message-id:user-agent :mime-version:content-type; bh=UfyvZsfG96h7jcfDBaLNbYYQziHVYzRUOHWbdFXwGZM=; b=PF54b5AId5XYhHTDilGOQhO9b/V/G4WCLIHt1XblgLrDGNmcvmouFv7HPieY7Lf+Iw kL4ufb6aSuyz0J9B/y9LkFovOcHQlafY5Bs13YvQ69sMAQUsOEaziD0bsk70EBm0ArTg 58Pvw7i7iUBMdZIPY8TEBCN6PnWMj1XpS5Ot0= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=from:to:cc:subject:organization:references:date:in-reply-to :message-id:user-agent:mime-version:content-type; b=qEWtzwvJ3llXoujSrhnVZK+6gt7ko0RKcCfLn6FpGYkqJ66NoqPXgXQRwvQReNxJpI sz9ib7m8QiouDSqvl+lcCHKBqUgCPkE5HS4/l2na6kCVGAPUQZf+5mH9CpD+sTuOkKSO fCkHnVBOjMZDyrPuJo7CnzNrRBGjqiH8p+4FE= Received: by 10.87.71.21 with SMTP id y21mr2682476fgk.69.1273840746385; Fri, 14 May 2010 05:39:06 -0700 (PDT) Received: from localhost (ua1.etadirect.net [91.198.140.16]) by mx.google.com with ESMTPS id 3sm818878fge.5.2010.05.14.05.39.05 (version=TLSv1/SSLv3 cipher=RC4-MD5); Fri, 14 May 2010 05:39:05 -0700 (PDT) From: Mikolaj Golub To: Julian Elischer Organization: TOA Ukraine References: <201005111814.o4BIEPfN071211@lava.sentex.ca> <4BE9BCE2.7070303@elischer.org> Date: Fri, 14 May 2010 15:39:03 +0300 In-Reply-To: <4BE9BCE2.7070303@elischer.org> (Julian Elischer's message of "Tue, 11 May 2010 13:24:02 -0700") Message-ID: <86pr0yiro8.fsf@zhuzha.ua1> User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/23.1 (berkeley-unix) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Cc: freebsd-net@freebsd.org, Mike Tancsa , Wes Peters Subject: Re: sockstat / netstat output 8.x vs 7.x X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 14 May 2010 12:39:08 -0000 On Tue, 11 May 2010 13:24:02 -0700 Julian Elischer wrote: JE> On 5/11/10 12:20 PM, Wes Peters wrote: >> The output header is instructive: >> >> USER COMMAND PID FD PROTO LOCAL ADDRESS FOREIGN ADDRESS >> www httpd 18423 3 tcp4 6 *:80 *:* >> www httpd 18423 4 tcp4 *:* *:* >> www httpd 25184 3 tcp4 6 *:80 *:* >> www httpd 25184 4 tcp4 *:* *:* >> >> Same as 7, it's the foreign address. This is normally only useful for >> connected sockets. >> >> On Tue, May 11, 2010 at 11:14 AM, Mike Tancsa wrote: >>> [trying on freebsd-net since no response on stable] >>> >>> I noticed that apache on RELENG_8 and RELENG_7 shows up with output I cant >>> seem to understand from sockstat -l and netstat -naW >>> >>> On RELENG_7, sockstat -l makes sense to me >>> .... >>> www httpd 83005 4 tcp4 *:443 *:* >>> www httpd 82217 3 tcp4 *:80 *:* >>> www httpd 82217 4 tcp4 *:443 *:* >>> www httpd 38942 3 tcp4 *:80 *:* >>> www httpd 38942 4 tcp4 *:443 *:* >>> root httpd 1169 3 tcp4 *:80 *:* >>> root httpd 1169 4 tcp4 *:443 *:* >>> >>> >>> various processes listening on all bound IP addresses on ports 80 and 443. >>> >>> On RELENG_8 however, it shows up with an extra entry (at the end) >>> >>> www httpd 29005 4 tcp4 *:* *:* >>> www httpd 29004 3 tcp4 6 *:80 *:* >>> www httpd 29004 4 tcp4 *:* *:* >>> www httpd 29003 3 tcp4 6 *:80 *:* >>> www httpd 29003 4 tcp4 *:* *:* >>> www httpd 66731 3 tcp4 6 *:80 *:* >>> www httpd 66731 4 tcp4 *:* *:* >>> root httpd 72197 3 tcp4 6 *:80 *:* >>> root httpd 72197 4 tcp4 *:* *:* >>> >>> >>> *:80 makes sense to me... process is listening on all IPs for port 80. What >>> does *:* mean then ? JE> I believe it has created a socket but not used it for anything JE> it may be the 6 socket... otherwise I don't see what a "tcp4 6" is JE> meant to be. Comparing RELENG_8 and RELENG_7 outputs it might be for https, which looks like is not configured on RELENG_8 host. I think socket() was called but no any other actions with the socket was performed. >>> >>> Netstat gives a slightly different version of it >>> >>> Active Internet connections (including servers) >>> Proto Recv-Q Send-Q Local Address Foreign Address (state) >>> tcp4 0 0 *.1984 *.* LISTEN >>> tcp4 0 0 *.* *.* CLOSED >>> tcp46 0 0 *.80 *.* LISTEN >>> >>> state closed ? You can reproduce this with this simple program: zhuzha:~/src/test_socket% cat test.c #include #include #include #include #include int main(int argc, char **argv) { int sockfd; if ((sockfd = socket(AF_INET, SOCK_STREAM, 0)) < 0) errx(1, "socket error"); sleep(60); return 0; } zhuzha:~/src/test_socket% make cc -g -O0 -Wall test.c -o test zhuzha:~/src/test_socket% ./test& [1] 56076 zhuzha:~/src/test_socket% sockstat|grep test golub test 56076 3 tcp4 *:* *:* zhuzha:~/src/test_socket% netstat -na |grep CLOSED tcp4 0 0 *.* *.* CLOSED -- Mikolaj Golub