From owner-freebsd-net@FreeBSD.ORG Wed Aug 25 16:21:26 2004 Return-Path: Delivered-To: freebsd-net@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id EA6B916A4CE for ; Wed, 25 Aug 2004 16:21:26 +0000 (GMT) Received: from c00l3r.networx.ch (c00l3r.networx.ch [62.48.2.2]) by mx1.FreeBSD.org (Postfix) with ESMTP id 3695843D2D for ; Wed, 25 Aug 2004 16:21:26 +0000 (GMT) (envelope-from andre@freebsd.org) Received: (qmail 42188 invoked from network); 25 Aug 2004 16:20:25 -0000 Received: from unknown (HELO freebsd.org) ([62.48.0.53]) (envelope-sender ) by c00l3r.networx.ch (qmail-ldap-1.03) with SMTP for ; 25 Aug 2004 16:20:25 -0000 Message-ID: <412CBC87.BFFA18E0@freebsd.org> Date: Wed, 25 Aug 2004 18:21:27 +0200 From: Andre Oppermann X-Mailer: Mozilla 4.8 [en] (Windows NT 5.0; U) X-Accept-Language: en MIME-Version: 1.0 To: Peter Pentchev References: <20040825153247.GI1009@straylight.m.ringlet.net> <20040825155723.GK1009@straylight.m.ringlet.net> Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit cc: net@FreeBSD.org Subject: Re: [CFR] Fix sockstat's handling of closed connections X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 25 Aug 2004 16:21:27 -0000 Peter Pentchev wrote: > > On Wed, Aug 25, 2004 at 05:48:38PM +0200, Andre Oppermann wrote: > > Peter Pentchev wrote: > [snip] > > > Luckily, the fix is simple, or at least so it seems to me. It turns out > > > that those connections have a xt_socket->xso_so set to NULL, and the > > > false positive comes from sockstat's matching them to a similarly NULL > > > xf_data members of 'kern.files'. What do people think about the > > > following patch? I could commit it if nobody has any objections, but > > > being a ports/doc committer, I would need an explicit approval to do > > > that :) > > > > The fix looks good to me. It seems small enough so I think I can give > > you the direct go-ahead to commit it. Could you also put a comment into > > the sockstat man page describing that TCP connections in TIME_WAIT state > > can be looked up with netstat? > > Thanks! I could easily fix the manpage, too, but is TIME_WAIT the only > state when xt_socket->xso_so is null? Someone with better knowledge of > the TCP/IP stack than me needs to either confirm that, or point out > which of the CLOSED, CLOSE_WAIT, FIN_WAIT_1, CLOSING, and FIN_WAIT_2 > states also have a null xso_so - or is it just TIME_WAIT, because all > the others still mean that the socket is still somewhat active? Good question. Maybe it's easier to phrase it the other way around. "TCP sockets not in LISTEN, SYN_SENT or ESTABLISHED state can be looked up with netstat." These are the ones that certainly have a file descriptor associated with them and thus show up in sockstat. -- Andre