Ubuntu
net-tools package

netstat does not display all PIDs

Bug #199702 reported by peterov on 2008-03-08

Affects		Status	Importance	Assigned to	Milestone
	net-tools (Ubuntu)	Fix Committed	Undecided	Unassigned
Nominated for Lucid by Stefan Praszalowicz

Bug Description

For some sockets (TCP and Unix), "netstat -p" does not display the PID.

Some further information:

# uname -a
Linux HOSTNAME 2.6.15-29-amd64-k8 #1 SMP PREEMPT Mon Sep 24 17:26:00 UTC 2007 x86_64 GNU/Linux

(Ubuntu dapper drake)

# netstat --version
net-tools 1.60
netstat 1.42 (2001-04-15)
Fred Baumgarten, Alan Cox, Bernd Eckenfels, Phil Blundell, Tuan Hoang and others
+NEW_ADDRT +RTF_IRTT +RTF_REJECT +FW_MASQUERADE +I18N
AF: (inet) +UNIX +INET +INET6 +IPX +AX25 +NETROM +X25 +ATALK +ECONET +ROSE
HW: +ETHER +ARC +SLIP +PPP +TUNNEL +TR +AX25 +NETROM +X25 +FR +ROSE +ASH +SIT +FDDI +HIPPI +HDLC/LAPB +EUI64

My suspicion is that it has something to do with the inode number of the sockets where
netstat cannot find an associated process.
Exim listens on port 25 and there is also the appropriate file under
/proc/<pid of exim>/fd/
but its inode number is higher than 0xa0000000.

In this output, the unix sockets with inode numbers such high are exactly the ones where
netstat cannot find a pid.

Perhaps there is a bug in the routine of netstat that builds the inode cache and perhaps it also
has something to do that it runs on a 64 bit system.

But these are only speculations ;-)

Tags:

Revision history for this message

peterov (peterov) wrote on 2008-03-08:

Output of netstat -anp Edit (12.2 KiB, text/plain)

Revision history for this message

Alexander (ap-ap) wrote on 2008-11-12:

Yes, this bug presents on my systems too.

Initially I'd suspected trouble with high PIDs, but no, on some other amd64 system with pid_max=99999 netstat seems to work properly.

Anyway, my system is 2.6.20 #2 SMP Fri Feb 16 19:57:57 MSK 2007 x86_64 GNU/Linux (custom kernel).

netstat --version
net-tools 1.60
netstat 1.42 (2001-04-15)
Fred Baumgarten, Alan Cox, Bernd Eckenfels, Phil Blundell, Tuan Hoang and others
+NEW_ADDRT +RTF_IRTT +RTF_REJECT +FW_MASQUERADE +I18N
AF: (inet) +UNIX +INET +INET6 +IPX +AX25 +NETROM +X25 +ATALK +ECONET +ROSE
HW: +ETHER +ARC +SLIP +PPP +TUNNEL +TR +AX25 +NETROM +X25 +FR +ROSE +ASH +SIT +FDDI +HIPPI +HDLC/LAPB +EUI64

Revision history for this message

Stefan Praszalowicz (stfp) wrote on 2009-01-23:

validate inode numbers against use LONG_MAX instead of INT_MAX Edit (865 bytes, text/plain)

Hey, I have the issue as well, and I believe the initial description is correct.

In two functions in netstat.c (extract_type_*_socket_inode), we parse inode numbers from /proc/PID/fd/* links, using strtol. The bugl is that we then compare the parsed value to INT_MAX, instead of LONG_MAX.

Please consider the patch :p !

Revision history for this message

Stefan Praszalowicz (stfp) wrote on 2010-03-08:

FYI, Bug and patch submitted upstream: http://developer.berlios.de/bugs/?func=detailbug&bug_id=16913&group_id=4537