Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

How do I find the inode of a TCP socket?

How do I tie values in the 'inode' column of /proc/net/tcp to files in /proc/<pid>/fd/?

I was under the impression that the inode column in the TCP had a decimal representation of the socket's inode, but that doesn't seem to be the case.

For example, if I run telnet localhost 80, I see the following (telnet is pid 9021).

/proc/net/tcp contains

sl  local_address rem_address   st tx_queue rx_queue tr tm->when retrnsmt   uid  timeout inode
23: 0100007F:CE2A 0100007F:0050 01 00000000:00000000 00:00000000 00000000  1000        0 361556 1 00000000 20 0 0 10 -1

which makes me think that the inode of the socket connected to 127.0.0.1:80 is 361556. But if I run ls --inode -alh /proc/9021/fd, I see

349886 lrwx------ 1 me me 64 Dec 26 10:51 3 -> socket:[361556]

The inode is 349886, which is different from the value in the inode column of the tcp table: 361556. But the link target seems to have the right name. Similarly, stat /proc/9021/3 shows:

File: ‘/proc/9021/fd/3’ -> ‘socket:[361556]’
Size: 64            Blocks: 0          IO Block: 1024   symbolic link
Device: 3h/3d   Inode: 349886      Links: 1

What's the number in the inode column of tcp table? Why doesn't it line up with the inode as reported by ls or stat?

(I'm running Ubuntu 14.10, if that matters)

like image 407
Erigami Avatar asked Dec 26 '14 16:12

Erigami


2 Answers

The inode shown by ls and stat is for the symlink that points to the inode associated with the socket. Running ls -iLalh shows the right inode. Ditto for stat -L.

Herpa derp derp. I only figured this out when I was composing my question. ;_;

like image 81
Erigami Avatar answered Oct 29 '22 04:10

Erigami


Inode id represent a file id per fs mount (proc, sys, ntfs, ext...), so as you probably understand you deal with two different fs here: procfs and some pseudo socket fs.

The files under the /proc/pid/fd/ directories are soft links which have inode representation in the procfs fs. These links are "pointing" to different "fs" - socket fs.

What stat -L and ls -iLalh do, is to give you the inode of the file the links points to. You can do this also explicitly with readlink /proc/#pid/fd/#fdnum

like image 26
Eytan Naim Avatar answered Oct 29 '22 05:10

Eytan Naim