From nobody Sat Feb 7 11:23:43 2026 X-Original-To: questions@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4f7T9Y1hp5z6Pg9f for ; Sat, 07 Feb 2026 11:23:45 +0000 (UTC) (envelope-from des@freebsd.org) Received: from smtp.freebsd.org (smtp.freebsd.org [96.47.72.83]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "smtp.freebsd.org", Issuer "R12" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4f7T9Y0hxHz3Lxl; Sat, 07 Feb 2026 11:23:45 +0000 (UTC) (envelope-from des@freebsd.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1770463425; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=folfzV8ULHOkaIYuKdLPMqP5rF5+wOejnp4Ku1Slg7M=; b=pXQHamxSqSQU7wuZmix7m7Gzr1yoj6pt+lSfNKhRdN0kBLWR+q1WKhA0c36er4GtH+SY+R dPUjj+pUnqYOtkKvsy6YicLeVDPrnc9MqGnCTa14EvjHUa0mt+wjvMsvZiSTkM/lHjM/mr w7+5ZnTJbzBClyvU2alXGbxQZXhAwlhN8CER/i/ncalNDCAuLNpdMQahm904B9+U0v1bKk kEG3nvfUK0RXaSUymvMjj1fC4r1vOEI7gYMiDclxlsTQZduq+gQaAwdBS212+DwlAgdg4Q xeIRq4wUXtTxXtffj3v4KC74gUTLS99qmS5oZpoybd4+GnLe18NsfwC103w7vg== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1770463425; a=rsa-sha256; cv=none; b=yW/AccPKTjIYg7jwzC0607Zmi4H3alZtVAvoV9jOVHW7RrOvvz/ZMaIXVe2XPzhkprifTT 6VfIUZ4dulRFtx/WdElYMrM7HdaNPivdzTvl4DhjzNsHu6+Za2a3HtxpGUdcZR0c7YIt6X XgLZFaBDueNxyDdFpAttxhQVFz8GS3t+oTeW1iaFMLBAaKraAzWxWFwFcy3TfkNu/pO39x ty69/KljFXoVvLnACAPaBc1EfIHNuv2jkMvO+DaFYkOobtMpgeypXRirtipjMm5FMYJUfS 5Xb2CxfH4CsIynOv+d3crZVC/7mmECEuZYuLK+YZWvTav64gs+vIUsCVOR1HTQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1770463425; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=folfzV8ULHOkaIYuKdLPMqP5rF5+wOejnp4Ku1Slg7M=; b=aHRukYnEDlvAbucjPQjrziOiJtPeNBXI7zjCEo2ua0/FRzWIMrRvOUlIQizdqh2NMiglL0 ObN2EuirZMSbXrX0XVAzVWfxmGcO22lrIunmhkhB+tiFgSd77O5gApbxtAYBmojief11+6 PVN8gqGNC9q/0doquBvL0dykHVKqU+pSlSkLWcdfSPryXfmy/jWcRp6/kCq8pRtqvrpl/e wxFr4uDqN2Dbv2dvYghN1cinFwVbpt4W3Uhzem1jLjYWR0rhFA1z/tZq0/6gD9yMoFxP+Z jGfDtbVFNA5eYymN+jIJsOO4FVz5NCUkkLAo/IwgTWt5c0ayr3wbt2WPqOPyNA== Received: from ltc.des.dev (lfbn-nan-1-698-103.w86-236.abo.wanadoo.fr [86.236.35.103]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) (Authenticated sender: des) by smtp.freebsd.org (Postfix) with ESMTPSA id 4f7T9X6SwLz12hK; Sat, 07 Feb 2026 11:23:44 +0000 (UTC) (envelope-from des@freebsd.org) Received: by ltc.des.dev (Postfix, from userid 1001) id 91A8972BB9; Sat, 07 Feb 2026 12:23:43 +0100 (CET) From: =?utf-8?Q?Dag-Erling_Sm=C3=B8rgrav?= To: Doug Hardie Cc: questions@freebsd.org Subject: Re: Strange sockstat entries In-Reply-To: <2133E787-9AF9-4999-83DC-83B4C0CABD32@lafn.org> (Doug Hardie's message of "Fri, 6 Feb 2026 12:05:59 -0800") References: <2133E787-9AF9-4999-83DC-83B4C0CABD32@lafn.org> User-Agent: Gnus/5.13 (Gnus v5.13) Date: Sat, 07 Feb 2026 12:23:43 +0100 Message-ID: <864insbxvk.fsf@ltc.des.dev> List-Id: User questions List-Archive: https://lists.freebsd.org/archives/freebsd-questions List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: freebsd-questions@freebsd.org Sender: owner-freebsd-questions@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Doug Hardie writes: > I am seeing a number of unusual sockstat entries that look like: > > ?? ?? ?? ?? tcp4 10.0.1.230:587 178.16.54.2= 2:63001 > > The occur at the end of the output. Often there are about 10 or so > entries. Most of them vanish after a few seconds. However, two are > quite persistent. What causes this type of entry? sockstat works by retrieving and cross-referencing information from two separate lists, one that ties sockets to processes and another that ties sockets to connections. If a socket is opened or closed while sockstat is working, it may show up in one list but not in the other. It might be better to drop incomplete entries by default. Note that sockets owned by the kernel (e.g. NFS) will never show up in the list of processes. Perhaps we should arrange things so they show up with PID and UID 0. DES --=20 Dag-Erling Sm=C3=B8rgrav - des@FreeBSD.org