Identifying specific tcp socket and ports ?

[Eric Lipede]

Hi there

via netstat, the following connections established by the computer mgcomp-11303-d can be seen.

netstat | grep mgcomp-11303-d
tcp 0 0 lonunix1.xx.xxxx.20222 mgcomp-11303-d.xx.xxxx.1519
tcp 0 0 lonunix1.xx.xxxx.5632 mgcomp-11303-d.xx.xxxx.1523
tcp 0 0 lonunix1.xx.xxxx.20222 mgcomp-11303-d.xx.xxxx.1521
mgcomp-11303-d.xx.xxxx.1298
tcp 0 0 lonunix1.xx.xxxx.445 mgcomp-11303-d.xx.xxxx.1179
mgcomp-11303-d.xx.xxxx.1526


So heres the question....

How do you identify the specific tcp socket associated with the connection "lonunix1.xx.xxxx.5632" and "mgcomp-11303-d.xx.xxxx.1523" ?


Doing a ndd -get /dev/tcp tcp_status |grep 172.050.107.103 <-...ip address shows..

e0000002055fdb28 172.050.107.103 8fe01425 8fe01425 0000fad3 000016f4 43df0a0d 43df0a0d 00008000 00500 01460 [4efe,5ef] TCP_ESTABLISHED
e0000002090b80a8 172.050.107.103 900221bd 900221bd 0000ffff 0000406b 151b840b 151b840b 00004000 00547 01460 [1600,5f3] TCP_ESTABLISHED
e0000001c64dcb28 172.050.107.103 8ff7b4d2 8ff7b4d2 0000ff7d 0000118a 8e13d313 8e13d313 00008000 00500 01460 [4efe,5f1] TCP_ESTABLISHED
e000000204e74b28 172.050.107.103 030fb013 030fb013 0000fd59 0000111d b0b88338 b0b88338 00008000 00500 01460 [17,512] TCP_ESTABLISHED
e0000001ce182b28 172.050.107.103 b1af1169 b1af1169 0000fd93 00001120 9f7515c7 9f7515c7 00002000 00500 01460 [1bd,49b] TCP_ESTABLISHED
e0000001fd42e5e8 172.050.107.103 92bbba7f 92bbba7f 0000fda4 00001130 d08a6afb d08a6afb 00008000 00500 01460 [17,5f6] TCP_ESTABLISHED

.....so...

6 references to the netstat output, how does one match them up.

The purpose of this excercise is knowing which connection to unhinge via ndd.

Thks in advance

v11.23

[James R. Ferguson · Accepted solution]

Hi Eric:

I suggest 'lsof':

http://hpux.connect.org.uk/hppd/cgi-bin/search?package=on&description=on&term=lsof

Regards!

...JRF...

[Eric Lipede]

Hi

Ive just worked out that the [4efe,5ef] pair translates to the dec port ref. !
thks for swinging by !
Eric

[Eric Lipede]

Thks James but lsof doesnt show the tcp socket that ndd can disconnect. Of course its a wonderful tool though!

[Eric Lipede]

.