Who started the scoket connection?

[Russell Boyd]

HP-UX 11
netstat -a gives you the local and foreign ip/scoket information.

How do you know which user (assuming that it was indeed a user who started the process) instigated a particular scoket connection?

Russell

[Sridhar Bhaskarla · Accepted solution]

You can find the corresponding process by using "lsof". Once you know the process you would know who the user was.

-Sri

[Russell Boyd]

whereis, which, man and find do not come up with an lsof command. Where is it found at?

Russell

[Jeff Schussele]

Hi Russell,

It's not in the HP core fileset.
Can be had from an HP porting site - like:

http://hpux.cs.utah.edu/hppd/hpux/Sysadmin/lsof-4.64/

Rgds,
Jeff

[Sridhar Bhaskarla]

lsof does not come bundled with HP-UX OS. But it is a famous tool. You can get it from the HP's porting site.

http://hpux.cs.utah.edu/hppd/hpux/Sysadmin/lsof-4.64/

-Sri

[rick jones]

indeed lsof will tell you which process is associated with a given socket. however, I don't think it can tell you if that process initiated the connection, or if the connection was initiated by the remote.

you might make some (reasonably good) guesses based on whether or not there is a local LISTEN socket bound to the same local port number.

the other wrinkle in knowing who started the connection is that the socket can be handed-off from one process to another, not necessarily via fork().