From nobody Fri Feb  6 20:05:59 2026
X-Original-To: questions@mlmmj.nyi.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1])
	by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4f74py0NfKz6FXmx
	for <questions@mlmmj.nyi.freebsd.org>; Fri, 06 Feb 2026 20:06:18 +0000 (UTC)
	(envelope-from bc979@lafn.org)
Received: from mail.sermon-archive.info (sermon-archive.info [47.181.130.121])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256)
	(Client did not present a certificate)
	by mx1.freebsd.org (Postfix) with ESMTPS id 4f74px0Vj5z3XTq
	for <questions@freebsd.org>; Fri, 06 Feb 2026 20:06:16 +0000 (UTC)
	(envelope-from bc979@lafn.org)
Authentication-Results: mx1.freebsd.org;
	dkim=none;
	dmarc=none;
	spf=pass (mx1.freebsd.org: domain of bc979@lafn.org designates 47.181.130.121 as permitted sender) smtp.mailfrom=bc979@lafn.org
Received: from smtpclient.apple (mini [10.0.1.251])
	by mail.sermon-archive.info (Postfix) with ESMTPSA id 4f74pn5cnFz1tDrP
	for <questions@freebsd.org>; Fri, 06 Feb 2026 12:06:09 -0800 (PST)
From: Doug Hardie <bc979@lafn.org>
Content-Type: text/plain;
	charset=us-ascii
Content-Transfer-Encoding: quoted-printable
List-Id: User questions <freebsd-questions.freebsd.org>
List-Archive: https://lists.freebsd.org/archives/freebsd-questions
List-Help: <mailto:questions+help@freebsd.org>
List-Post: <mailto:questions@freebsd.org>
List-Subscribe: <mailto:questions+subscribe@freebsd.org>
List-Unsubscribe: <mailto:questions+unsubscribe@freebsd.org>
X-BeenThere: freebsd-questions@freebsd.org
Sender: owner-freebsd-questions@FreeBSD.org
Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3864.300.41.1.7\))
Subject: Strange sockstat entries
Message-Id: <2133E787-9AF9-4999-83DC-83B4C0CABD32@lafn.org>
Date: Fri, 6 Feb 2026 12:05:59 -0800
To: questions@freebsd.org
X-Mailer: Apple Mail (2.3864.300.41.1.7)
X-Virus-Scanned: clamav-milter 1.5.1 at mail
X-Virus-Status: Clean
X-Spamd-Result: default: False [1.38 / 15.00];
	NEURAL_HAM_SHORT(-1.00)[-0.996];
	NEURAL_SPAM_LONG(0.99)[0.990];
	NEURAL_SPAM_MEDIUM(0.99)[0.989];
	MV_CASE(0.50)[];
	R_SPF_ALLOW(-0.20)[+mx];
	ONCE_RECEIVED(0.20)[];
	MIME_GOOD(-0.10)[text/plain];
	RCVD_VIA_SMTP_AUTH(0.00)[];
	ASN(0.00)[asn:5650, ipnet:47.181.128.0/18, country:US];
	RCVD_COUNT_ONE(0.00)[1];
	RCPT_COUNT_ONE(0.00)[1];
	MIME_TRACE(0.00)[0:+];
	MID_RHS_MATCH_FROM(0.00)[];
	R_DKIM_NA(0.00)[];
	MLMMJ_DEST(0.00)[questions@freebsd.org];
	FROM_EQ_ENVFROM(0.00)[];
	FROM_HAS_DN(0.00)[];
	ARC_NA(0.00)[];
	TO_DN_NONE(0.00)[];
	PREVIOUSLY_DELIVERED(0.00)[questions@freebsd.org];
	TO_MATCH_ENVRCPT_ALL(0.00)[];
	DMARC_NA(0.00)[lafn.org: no valid DMARC record];
	RCVD_TLS_ALL(0.00)[]
X-Rspamd-Queue-Id: 4f74px0Vj5z3XTq
X-Spamd-Bar: +

I am seeing a number of unusual sockstat entries that look like:

??       ??            ??    ?? tcp4    10.0.1.230:587        =
178.16.54.22:63001

The occur at the end of the output.  Often there are about 10 or so =
entries.  Most of them vanish after a few seconds.  However, two are =
quite persistent.  What causes this type of entry?

-- Doug