Messages in this thread | | | Date | Sat, 22 Apr 2006 15:34:22 +0200 (MEST) | From | Jan Engelhardt <> | Subject | Re: unix socket connection tracking |
| |
>>>>> I feel dumb as never so please enlight me. Is ther a way to find out which >>>>> process is on the other end of a unix socket pointed by a specified fd in a process. >>>> getpeer*() >>> getpeername(2) (that is the only man page I've got) >>> >> Exactly. And if you do the same on another socket from another process, you >> can match up what sockets are connected. >> You always need to examine more than one process. (Unless the process talks >> to itself.) > >But how can I examine a file-descriptor (socket) from within other process. Like >this. > >A [fd:4]------[fd:6] B -+ >| | >`---[ptrace] C [ptrace]-' >
7315 pts/9 S+ 0:00 | \_ ssh jengelh@lo 3698 ? Ss 0:00 /usr/sbin/sshd -o PidFile=/var/run/sshd.init.pid 7316 ? Ss 0:00 \_ sshd: jengelh [priv] 7320 ? S 0:00 \_ sshd: jengelh@pts/10 7321 pts/10 Ss 0:00 \_ -bash
Just look at all processes and logically connect them:
15:32 shanghai:/D/home/jengelh # l /proc/7315/fd total 7 dr-x------ 2 root root 0 Apr 22 15:32 . dr-xr-xr-x 5 root root 0 Apr 22 15:32 .. lrwx------ 1 root root 64 Apr 22 15:32 0 -> /dev/pts/9 lrwx------ 1 root root 64 Apr 22 15:32 1 -> /dev/pts/9 lrwx------ 1 root root 64 Apr 22 15:32 2 -> /dev/pts/9 lrwx------ 1 root root 64 Apr 22 15:32 3 -> socket:[85928] lrwx------ 1 root root 64 Apr 22 15:32 4 -> /dev/pts/9 lrwx------ 1 root root 64 Apr 22 15:32 5 -> /dev/pts/9 lrwx------ 1 root root 64 Apr 22 15:32 6 -> /dev/pts/9
15:33 shanghai:/D/home/jengelh # l /proc/7316/fd/ total 6 dr-x------ 2 root root 0 Apr 22 15:32 . dr-xr-xr-x 5 root root 0 Apr 22 15:32 .. lrwx------ 1 root root 64 Apr 22 15:32 0 -> /dev/null lrwx------ 1 root root 64 Apr 22 15:33 1 -> /dev/null lrwx------ 1 root root 64 Apr 22 15:33 2 -> /dev/null lrwx------ 1 root root 64 Apr 22 15:33 3 -> socket:[85929] lrwx------ 1 root root 64 Apr 22 15:33 4 -> /dev/ptmx lrwx------ 1 root root 64 Apr 22 15:33 5 -> socket:[85959]
No need for ptrace. No need for getpeername() either, but it's useful to get the real addresses of sockets.
Jan Engelhardt -- - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |