Date: Wed, 12 May 2010 13:50:31 -0400 From: Mike Tancsa <mike@sentex.net> To: Julian Elischer <julian@elischer.org> Cc: freebsd-net@freebsd.org Subject: Re: sockstat / netstat output 8.x vs 7.x Message-ID: <201005121750.o4CHoaAI079582@lava.sentex.ca> In-Reply-To: <4BE9BCE2.7070303@elischer.org> References: <201005111814.o4BIEPfN071211@lava.sentex.ca> <AANLkTinEjLEbGv_TIDWTz_rDxc4S_EDr_mCMmd0cINzl@mail.gmail.com> <4BE9BCE2.7070303@elischer.org>
next in thread | previous in thread | raw e-mail | index | archive | help
At 04:24 PM 5/11/2010, Julian Elischer wrote:
>On 5/11/10 12:20 PM, Wes Peters wrote:
>>The output header is instructive:
>>
>>USER COMMAND PID FD PROTO LOCAL ADDRESS FOREIGN ADDRESS
>>www httpd 18423 3 tcp4 6 *:80 *:*
>>www httpd 18423 4 tcp4 *:* *:*
>>www httpd 25184 3 tcp4 6 *:80 *:*
>>www httpd 25184 4 tcp4 *:* *:*
>>
>>Same as 7, it's the foreign address. This is normally only useful for
>>connected sockets.
>>
>>On Tue, May 11, 2010 at 11:14 AM, Mike Tancsa<mike@sentex.net> wrote:
>>>[trying on freebsd-net since no response on stable]
>>>
>>>I noticed that apache on RELENG_8 and RELENG_7 shows up with output I cant
>>>seem to understand from sockstat -l and netstat -naW
>>>
>>>On RELENG_7, sockstat -l makes sense to me
>>>....
>>>www httpd 83005 4 tcp4 *:443 *:*
>>>www httpd 82217 3 tcp4 *:80 *:*
>>>www httpd 82217 4 tcp4 *:443 *:*
>>>www httpd 38942 3 tcp4 *:80 *:*
>>>www httpd 38942 4 tcp4 *:443 *:*
>>>root httpd 1169 3 tcp4 *:80 *:*
>>>root httpd 1169 4 tcp4 *:443 *:*
>>>
>>>
>>>various processes listening on all bound IP addresses on ports 80 and 443.
>>>
>>>On RELENG_8 however, it shows up with an extra entry (at the end)
>>>
>>>www httpd 29005 4 tcp4 *:* *:*
>>>www httpd 29004 3 tcp4 6 *:80 *:*
>>>www httpd 29004 4 tcp4 *:* *:*
>>>www httpd 29003 3 tcp4 6 *:80 *:*
>>>www httpd 29003 4 tcp4 *:* *:*
>>>www httpd 66731 3 tcp4 6 *:80 *:*
>>>www httpd 66731 4 tcp4 *:* *:*
>>>root httpd 72197 3 tcp4 6 *:80 *:*
>>>root httpd 72197 4 tcp4 *:* *:*
>>>
>>>
>>>*:80 makes sense to me... process is listening on all IPs for port 80. What
>>>does *:* mean then ?
>
>I believe it has created a socket but not used it for anything
>it may be the 6 socket... otherwise I don't see what a "tcp4 6" is
>meant to be.
Should not sockstat and netstat agree ? one says closed, the other not
---Mike
>>>Netstat gives a slightly different version of it
>>>
>>>Active Internet connections (including servers)
>>>Proto Recv-Q Send-Q Local Address Foreign Address (state)
>>>tcp4 0 0 *.1984 *.* LISTEN
>>>tcp4 0 0 *.* *.* CLOSED
>>>tcp46 0 0 *.80 *.* LISTEN
>>>
>>>state closed ?
>>>
>>> ---Mike
>>>
>>>
>>>
>>>--------------------------------------------------------------------
>>>Mike Tancsa, tel +1 519 651 3400
>>>Sentex Communications, mike@sentex.net
>>>Providing Internet since 1994 www.sentex.net
>>>Cambridge, Ontario Canada www.sentex.net/mike
>>>
>>>_______________________________________________
>>>freebsd-net@freebsd.org mailing list
>>>http://lists.freebsd.org/mailman/listinfo/freebsd-net
>>>To unsubscribe, send any mail to "freebsd-net-unsubscribe@freebsd.org"
>>
>>
--------------------------------------------------------------------
Mike Tancsa, tel +1 519 651 3400
Sentex Communications, mike@sentex.net
Providing Internet since 1994 www.sentex.net
Cambridge, Ontario Canada www.sentex.net/mike
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201005121750.o4CHoaAI079582>