Re: unix socket connection tracking

[Jan Engelhardt <jengelh@linux01.gwdg.de>]

>>>>> I feel dumb as never so please enlight me. Is ther a way to find out which
>>>>> process is on the other end of a unix socket pointed by a specified fd in a process.
>>>> getpeer*()
>>> getpeername(2) (that is the only man page I've got)
>>>
>> Exactly. And if you do the same on another socket from another process, you 
>> can match up what sockets are connected.
>> You always need to examine more than one process. (Unless the process talks 
>> to itself.)
>
>But how can I examine a file-descriptor (socket) from within other process. Like
>this.
>
>A [fd:4]------[fd:6] B -+
>|                       |
>`---[ptrace] C [ptrace]-'
>

 7315 pts/9    S+     0:00          |               \_ ssh jengelh@lo
 3698 ?        Ss     0:00 /usr/sbin/sshd -o PidFile=/var/run/sshd.init.pid
 7316 ?        Ss     0:00  \_ sshd: jengelh [priv]                            
 7320 ?        S      0:00      \_ sshd: jengelh@pts/10                        
 7321 pts/10   Ss     0:00          \_ -bash

Just look at all processes and logically connect them:

15:32 shanghai:/D/home/jengelh # l /proc/7315/fd
total 7
dr-x------  2 root root  0 Apr 22 15:32 .
dr-xr-xr-x  5 root root  0 Apr 22 15:32 ..
lrwx------  1 root root 64 Apr 22 15:32 0 -> /dev/pts/9
lrwx------  1 root root 64 Apr 22 15:32 1 -> /dev/pts/9
lrwx------  1 root root 64 Apr 22 15:32 2 -> /dev/pts/9
lrwx------  1 root root 64 Apr 22 15:32 3 -> socket:[85928]
lrwx------  1 root root 64 Apr 22 15:32 4 -> /dev/pts/9
lrwx------  1 root root 64 Apr 22 15:32 5 -> /dev/pts/9
lrwx------  1 root root 64 Apr 22 15:32 6 -> /dev/pts/9

15:33 shanghai:/D/home/jengelh # l /proc/7316/fd/
total 6
dr-x------  2 root root  0 Apr 22 15:32 .
dr-xr-xr-x  5 root root  0 Apr 22 15:32 ..
lrwx------  1 root root 64 Apr 22 15:32 0 -> /dev/null
lrwx------  1 root root 64 Apr 22 15:33 1 -> /dev/null
lrwx------  1 root root 64 Apr 22 15:33 2 -> /dev/null
lrwx------  1 root root 64 Apr 22 15:33 3 -> socket:[85929]
lrwx------  1 root root 64 Apr 22 15:33 4 -> /dev/ptmx
lrwx------  1 root root 64 Apr 22 15:33 5 -> socket:[85959]

No need for ptrace. No need for getpeername() either, but it's useful to 
get the real addresses of sockets.


Jan Engelhardt
-- 
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/