StackOverflow2013

Note that there are some explanatory texts on larger screens.

plurals

POList of possible internal socket statuses from /proc
text
Body
copied!<p>I would like to know the possible values of <code>st</code> column in <code>/proc/net/tcp</code>. I think the <code>st</code> column equates to STATE column from <code>netstat(8)</code> or <code>ss(8)</code>.</p> <p>I have managed to identify three codes:</p> <pre><code>sl local_address rem_address st tx_queue rx_queue tr tm->when retrnsmt uid timeout inode 0: 0100007F:08A0 00000000:0000 0A 00000000:00000000 00:00000000 00000000 0 0 7321 1 ffff81002f449980 3000 0 0 2 -1 1: 00000000:006F 00000000:0000 0A 00000000:00000000 00:00000000 00000000 0 0 6656 1 ffff81003a30c080 3000 0 0 2 -1 2: 00000000:0272 00000000:0000 0A 00000000:00000000 00:00000000 00000000 0 0 6733 1 ffff81003a30c6c0 3000 0 0 2 -1 3: 0100007F:0277 00000000:0000 0A 00000000:00000000 00:00000000 00000000 0 0 7411 1 ffff81002f448d00 3000 0 0 2 -1 4: 0100007F:0019 00000000:0000 0A 00000000:00000000 00:00000000 00000000 0 0 7520 1 ffff81002f4486c0 3000 0 0 2 -1 5: 0100007F:089F 00000000:0000 0A 00000000:00000000 00:00000000 00000000 0 0 7339 1 ffff81002f449340 3000 0 0 2 -1 6: 0100007F:E753 0100007F:0016 01 00000000:00000000 02:000AFA92 00000000 500 0 18198 2 ffff81002f448080 204 40 20 2 -1 7: 0100007F:E752 0100007F:0016 06 00000000:00000000 03:000005EC 00000000 0 0 0 2 ffff81000805dc00 </code></pre> <p>The above shows:</p> <ul> <li>On line sl 0: a listening port on tcp/2208. <code>st = 0A = LISTEN</code> </li> <li>On line sl 6: An established session on tcp/22. <code>st = 01 = ESTABLISHED</code></li> <li>On line sl 7: An socket in TIME_WAIT state after ssh logout. No inode. <code>st = 06 = TIME_WAIT</code></li> </ul> <p>Can anyone expand on this list? The <code>proc(5)</code> manpage is quite terse on the subject stating:</p> <pre><code> /proc/net/tcp Holds a dump of the TCP socket table. Much of the information is not of use apart from debugging. The "sl" value is the kernel hash slot for the socket, the "local address" is the local address and port number pair. The "remote address" is the remote address and port number pair (if connected). ’St’ is the internal status of the socket. The ’tx_queue’ and ’rx_queue’ are the outgoing and incom- ing data queue in terms of kernel memory usage. The "tr", "tm->when", and "rexmits" fields hold internal information of the kernel socket state and are only useful for debugging. The "uid" field holds the effective UID of the creator of the socket. </code></pre> <p>And on a related note, the above /proc/net/tcp output is showing a few listening processes (2208, 62, 111 etc). However, I cannot see a listening tcp connection on tcp/22, althought the established and time_wait states are shown. Yes, I can see them in <code>/proc/net/tcp6</code> but should they not be present in <code>/proc/net/tcp</code> also? Netstat output shows it differently to applications bound only to ipv4. E.g.</p> <pre><code>tcp 0 0 0.0.0.0:111 0.0.0.0:* LISTEN 4231/portmap tcp 0 0 :::22 :::* LISTEN 4556/sshd </code></pre> <p>Many thanks, -Andrew</p>

Querying!

Guidance

An individual column

Larger individual text columns get their own page to allow for proper reading.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload