UX Socket Communication Quandry

[TrustNo1]

We are having a problem tracking a socket type communication process.
The client loses connection, and we are left with a socket connection hanging with no client attached.
ie (from Glance) inet,udp,*:3891 -> (any:0)

We have tracked the process with "glance" and "lsof" to no avail. (any "lsof" ideas?)
We want to find out who the owner of the parent process was.
Is there a way to log socket commnications without turning on a full auditing system?
Thanks,
~jdk

[Berlene Herren · Accepted solution]

How about running a nettl trace (or tcpdump)?

Berlene

[TrustNo1]

Thank you for the reply Berlene,
I am unsure what "tcpdump" is exactly, so, I'm looking into the "nettl trace" option.
It looks like a little more than I can handle, so I will contact the ITRC support crew to be sure I get it right (Production Machine).
ps the ENV is/was "K460 - 10.20"
Thanks again!
~jdk

[rick jones]

tcpdump is (imo) a nicer way to take packet traces than nettl. get the latest revs from www.tcpdump.org

iirc, glance only shows sockets in the context of a process, so if you see a socket in glance, it means the process open files you are looking at has a reference to that socket. (or have i missed a way for glance to show all open fds on a system?)

modulo a bug in the socket code, when the last process with a reference to a socket goes away, the socket is closed. also, for a UDP socket, there is no (reliable) notification that the other end of the communicatino has gone away as there is no real "connection" in the sense of TCP (even though one can call "connect()" on a UDP socket - it is really just a convenience)