lsof doesn't show nfsd port 2049 - what are /dev/udp or tcp links?

[Jeff Lightner_1]

We were trying to install a SW package that requested a range of ports and gave it a range that included 2049. It failed because 2049 is apparently in use by nfsd. We found this in â netstat â anâ and then found 2049 in /etc/services.

So my questions:
1) Why doesn't port 2049 show up in lsof (Please review below and attached output before suggesting it the port is not active or I don't know how to use lsof.)
2) Is it the odd links to /dev/udp that make it active and if so how would I know it was port 2049 from the links? (That is if I didn't have a port defined in /etc/services named nfsd how would I have known to this was nfsd using it?)

What I see:

netstat â an |grep 2049
(IPs obfuscated with xx)
tcp 0 0 *.2049 *.* LISTEN
tcp 0 0 10.0.xx.xx.2049 10.0.xx.xx.599 ESTABLISHED
tcp 0 0 10.0.xx.xx.2049 10.0.xx.xx.607 ESTABLISHED
tcp 0 0 10.0.xx.xx.2049 10.0.xx.xx.811 ESTABLISHED
udp 0 0 *.2049 *.*
udp 0 0 *.2049 *.*
udp 0 0 *.2049 *.*
udp 0 0 *.2049 *.*

lsof â i :2049
Shows nothing


lsof |grep 2049:
bptm 28172 root 11u CHR 203,0x1f3100 0t0 2049 /dev/sctl/c31t3l1
(This has nothing to do with nfsd â just showing that nowhere in lsof does it see PORT 2049).


lsof |grep nfsd - in attachment.



And finally:
ls -l /dev/udp
crw-rw-rw- 1 root root 72 0x000016 Oct 6 17:17 /dev/udp


Not sure what the /dev/udp-> (or /dev/tcp->) stuff in above output is â it appears to me it is showing some sort of link to the port which is why I question this. Also is a "STR" filehandle a "stream"?

[Jeff Schussele]

Hi Jeff,

That lsof command should be:

lsof -i UDP:2049

or if your NFS is TCP - then:

lsof -i TCP:2049

You have to denote the protocol to lsof

HTH,
Jeff

[Jeff Lightner_1]

Thanks for replying but this is not the issue.

While specifying the protocol is an option it is not required. It merely restricts it to the protocol of the port (TCP or UDP). Without it lsof -i would find the port regardless of type.

Example: lsof -i :80, lsof -i :http, lsof -i TCP:80 would all find http running under TCP protocol on port 80. However lsof -i UDP:80 would NOT find it because it doesn't run on UDP protocol.

In any event I did try both lsof TCP:2049 and lsof UDP:2049 as you suggested and they didn't show anything more than just "lsof -i :2049" did.

[Jeff Lightner_1]

Update on this.

I later noticed that lsof DOES report the port for nfsd on HP-UX 11.00 - the issue only occurs on 11.11 (and probably 11.23 - haven't looked there).

Having gotten no solution on this list or on the Dutchworks list I decided to write the author of lsof, Mr. Vic Abell. He not only was gracious enough to answer but has been doing follow up with his contacts within HP.

The first thing he did was point me to the lsof FAQ which explains why some ports that would be open are not seen by lsof. As I had never run into this before and had been using lsof for some years it hadn't even occurred to me to reread the FAQ. It was an interesting read so I'd definitely recommend it for any lsof question even if you've been using it for a while like I have.

In any event Vic said it was OK to post an intermediate answer as it may be some time (if ever) before any changes are made by HP to allow lsof to see these ports. That is because this isn't exactly a bug but rather a different way of doing things so HP may or may not decide to address it.

Vic's summary of the reason:
..."lsof is unable to report on the connection parameters (e.g., IP address, port number, window sizes, queue lengths, etc.) of a TLI/XTI stream, such as the one nfsd is using, because the PSTAT(2) interface from which lsof gets all HP-UX 11.11 open file information is not receiving connection parameters from the kernel TLI/XTI modules and therefore can't report them to lsof."

My thanks to those who responded. Also of course great thanks to Vic Abell who continues to do follow up with HP.

I'll leave the thread open so if there is a further update later I can post it.

[Jeff Lightner_1]

UPDATE: Vic and his HP contact had not gotten much movement on this so he suggested I open a Service Request (SAR). After speaking to my ASC he opened one.

The service request is JAGaf96371. The title given to the problem was:
lsof (pstatt) does not display TLI/XTI socket applications correctly.

If anyone else has interest in having HP make changes to get this resolved I'd urge you to contact your HP representatives and let them know. My justification for the SAR is that lsof is in wide use among HP-UX admins and also is a multi-platform tool. Having other admins indicate interest in the SAR would likely help vindicate the justification and move it along.

[Jeff Lightner_1]

There has been some movement since my last update. HP apparently patched this issue for one service which let Vic and I question why it wouldn't be patched for other things.

It does appear in newer versions HP will address the issue and that they may actually issue a patch for this but I'm not holding my breath on the latter. At least I've now seen acknowledgment from HP that this is something they intend to address.