How to find more information about the file descriptor?

Question

I am trying to debug a process that hangs, the output of strace for the process id has last line :
recvfrom(9, <detached ...> From this what I understand that the process is waiting on the socket.

But I don't know which or what kind of socket is this. How can I discover more about this ? does the file descriptor 9 will give me more information ? How can I use this file discover to know more about what it is waiting for ?

its a python process, running in linux.

Answer 1

Since you are using strace I assume you are on Linux and you know the process id. In that case you can find a lot of info in /proc. Here is an example of what to do.

Do ls -l /proc/<pid>/fd. There will be an entry corresponding to the fd you are interested in and that fd should be a socket as such:

$ ls -l /proc/3311/fd
total 0
lrwx------ 1 alanau alanau 64 Sep 24 20:37 0 -> /dev/pts/0
lrwx------ 1 alanau alanau 64 Sep 24 20:37 1 -> /dev/pts/0
lrwx------ 1 alanau alanau 64 Sep 24 20:37 2 -> /dev/pts/0
lrwx------ 1 alanau alanau 64 Sep 24 20:37 3 -> socket:[23182]

In the above example, 3 is the socket of interest. The number after socket is the inode number, 23182 in this case.

Now look in the file /proc/net/tcp to find that inode:

$ cat /proc/net/tcp | grep 23182
   2: 0F02000A:C43B 8EDC3AD8:0050 01 00000000:00000000 00:00000000 00000000  1000        0 **23182** 1 0000000000000000 23 0 0 10 -1

The first line of /proc/net/tcp tells you what each field represents:

 sl  local_address rem_address   st tx_queue rx_queue tr tm->when retrnsmt   uid  timeout inode

So in this example, the remote address is 8EDC3AD8:0050. That's the ip_addres:port_number in hex and network byte ordering. If you convert that to decimal it is 216.58.220.142:80.

Which tells you it is in fact a TCP connection to port 80 of google.com!

If you don't find the inode number in /proc/net/tcp then try the other protocols in the directory, probably /proc/net/udp.