Cannot match up PID's with TCP/IP sockets using netstat...

[Rick Braman]

Hi gang,

I'm running HP-UX 11.11 and am having a problem trying to match up PID's with the TCP/IP socket that it was initiated from.

I also have a Linux server here whose netstat command uses the -p option much differently than HP-UX's netstat does. On Linux, the -p option shows the PID and name of the program to which each socket belongs.

This is exactly what I'm looking for. Is there a newer binary set for netstat that I need to download and install on my HP-UX server, or is there another way of retrieving this information?

Any insight would be greatly appreciated!

Thanks,

Rick

[Robert Salter]

Try lsof,
ftp://vic.cc.purdue.edu/pub/tools/unix/lsof/

cheers

[Borislav Perkov]

Hi Rick,
lsof will fulfill your task, but you have a problems installing from the depot. You have to recompile it on your machine.
Regards,
Borislav

[rick jones]

Indeed, -p on HP-UX netstat is (properly, IMO :) :) :) for specifying a protocol and getting its statistics.

If and when you see output in netstat -an with no corresponding entry in lsof output, check ndd /dev/tcp tcp_status - the entries with "*" after the TCP state mean they have no associated socket/process and so would not appear in lsof output.

Examples would be TIME_WAIT's, and perhaps any of the FIN_WAIT states. Even ESTABLISHED is possible - for connections that have been established, but for which accept() has yet to be called.

[Steven E. Protter]

lsof will show an install error and then be usable. You can manually set suid on one file it complains about and it will be totally usable.

SEP