how do I find out what program's on the other end of a local socket?

Question

A process on my Linux system, strace tells me, is talking on a socket which has file descriptor 10. lsof tells me that this is a unix socket with inode 11085, and netstat further tells me that inode 11085 a stream socket, and that it's connected.

Given that this process doesn't have any other threads, there must therefore be another process on the system that's connected to the other end of this socket. How do I find out what it is?

Update:

There's some illumination from the lsof author here. Essentially, it seems that Linux just doesn't provide this information.

Answer 1

Does netstat -p help ?

From Manpage:

  -p,
  --program Show the PID and name of the program to which each socket belongs.

Answer 2

If for some reason you have no luck with the appropriate lsof and netstat options, you can also do the following:

find /proc -lname '*11085*' 2> /dev/null

Answer 3

How about this: grep 11085 /proc/net/unix. Assuming there is a non-empty path present on the line with the inode you're interested in, grep for that path in /proc/net/unix to find the the inode for the other end of the connection, then use efficientjelly's method to map the other inode to a pid.

A key point here is the fact that the two connected sockets will each have a different inode number.

Answer 4

Simply Just print the socket object also u can use socket.getRemotePort()

Thanks Bapi

Answer 5

The reply from lsof author is seven years old. Is it still not possible to get this information from Linux kernel?

FWIW lsof on RHEL5 shows some memory address in the DEVICE column. According to lsof(8) this might be "a kernel reference address that identifies the file (The kernel reference address may be used for FIFO's, for example.)". Is there any to resolve this address into details about the pipe?

Answer 6

Looks like if you're really desperate, you can get that information directly from Linux kernel memory by using some kernel debugger. With RHEL5's "crash" tool:

• get uncompressed vmlinux image (eg. install kernel-debuginfo rpm, or extract vmlinux file from that rpm)
• run "crash /path/to/vmlinux"
• "net -s 12345" lists all sockets for PID 12345
• find the interesting socket (has to be of family/type "UNIX:STREAM"), and note its "SOCK" value:
  • PID: 12345 TASK: e903d000 CPU: 0 COMMAND: "someapp"
  • FD SOCKET SOCK FAMILY:TYPE SOURCE-PORT DESTINATION-PORT
  • 36 cadd0240 c8a64040 UNIX:STREAM
• you now have the address of the unix_sock struct for this socket
  • basically, unix_sock.peer.name is the name structure of the other end of the socket
  • print it with "p ((*((struct unix_sock*)( (struct unix_sock*)0xc8a64040)->peer)).addr).name"

Really sad that this information is not directly exported to userspace.