Date: Tue, 19 Feb 2019 14:04:05 -0800 From: Steve Kargl <sgk@troutmask.apl.washington.edu> To: Mike Tancsa <mike@sentex.net> Cc: Freddie Cash <fjwcash@gmail.com>, BBlister <bblister@gmail.com>, FreeBSD Hackers <freebsd-hackers@freebsd.org> Subject: Re: userland process rpc.lockd opens untraceable ports...is something wrong here? Message-ID: <20190219220404.GA1668@troutmask.apl.washington.edu> In-Reply-To: <7b44b3ce-9b96-e91b-b9ca-57100c784db7@sentex.net> References: <1550610819543-0.post@n6.nabble.com> <CAOjFWZ7kJoa-_EVBrLUwLrs9J7ERWqkRf4bZh_giQ4-NRrGS_w@mail.gmail.com> <7b44b3ce-9b96-e91b-b9ca-57100c784db7@sentex.net>
next in thread | previous in thread | raw e-mail | index | archive | help
On Tue, Feb 19, 2019 at 04:38:50PM -0500, Mike Tancsa wrote: > On 2/19/2019 4:24 PM, Freddie Cash wrote: > > While it doesn't take you from a socket/port to a process, does > > procstat at > > least show you the sockets that rpc.lockd has open? > > > > Something like: procstat -f <pid-of-rpc.lockd> > > > > Although, one could probably run the following to get from the socket/port > > number to the process: procstat -f -a | grep 600 > > It doesnt seem to. sockstat shows > > # sockstat | grep "^?" > ? ? ? ? tcp4 *:845 *:* > ? ? ? ? udp4 *:833 *:* > ? ? ? ? udp4 *:2049 *:* > ? ? ? ? udp6 *:976 *:* > ? ? ? ? tcp6 *:882 *:* > ? ? ? ? udp4 *:* *:* > ? ? ? ? udp6 *:938 *:* > ? ? ? ? udp6 *:2049 *:* The sockstat(8) manuals states If a socket is not associated with any file descriptor, the first four columns have no meaning. -- Steve
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20190219220404.GA1668>