Find connection status with socket file descriptor under Linux system

Proc Virtual file System There are many digitally named subdirectories that represent the process number that the system is currently running;

The/PROC/N/FD directory below holds an open file descriptor that points to a link to the actual file. As follows:

[[Email protected]_10_1_17_138 song_test]# ll/proc/25465/fdtotal 0lrwx------1 root root * 09:36 0-/dev/pts /4 (Deleted) lrwx------1 root root Apr 09:36 1-/DEV/PTS/4 (deleted) lrwx------1 root root 14 April 09:36 10- > socket:[2289128790]lrwx------1 root root 09:36-socket:[2305227922]lrwx------1 root root 09:36 101-socket:[2305224138]lrwx------1 root root April 09:36 102-socket:[2305233625]lrwx------1 Roo T Root 09:36 103-socket:[2305215571]lrwx------1 root root April 09:36 104 WX------1 root root 09:36 socket:[2305394065]lrwx------1 root root 09:36 106 socket: [2305394002]

We want to see the link state of the 101 socket file descriptor. Smart Note that there is a number "2305224138" in the back, where does this number come from? Spectators, please look down.

The status information for all TCP links is saved under the/proc/net/tcp directory.

[[email protected]_10_1_17_138 song_test]# cat/proc/net/tcp sl local_address rem_address St Tx_queue Rx_queue tr Tm->when retrnsmt uid Timeout inode 0:8a11010a:7dc8 0000000                    0:0000 0A 00000000:00000000 00:00000000 00000000 0 0 764789417 1 FFFF881051DFCB40 99 0 0 10-1  1:8a11010a:0369 00000000:0000 0A 00000000:00000000 00:00000000 00000000 0 0 737748331 1 ffff88106af8f7c0 99 0 0 10-1 51:8a11010a:faf4 9c01010a:0cea 00000000:00000000 03:00000938 00000000 0 0 0 2 ffff8810516c0         1c0 52:8A11010A:21CD 0964010a:2227 01 00000000:00000000 00:00000000 00000000 0 0 2305224138 2 ffff8801402f55c0 3 10-1 53:8a11010a:fb8a 9c01010a:0cea 06 00000000:00000000 0 3:000012a8 00000000 0 0 0 2 ffff8810516c04c0 54:8a11010a:73e5 4511010A: 0050 06 00000000:00000000 03:00000ea8 00000000 0 0 0 2 ffff88106898a880 55:8a11010a:89ad F30001                        0a:1f90 00000000:00000001 00:00000000 00000000 0 0 2305271480 1 ffff880869b59740 23 3 0 10-1                                       187:8A11010A:0ACB 8811010a:1f90 00000000:00000000 03:0000028e 00000000 0 0 0 2 ffff881050e9ccc0        188:8a11010a:fb6c 9c01010a:0cea 00000000:00000000 03:000010CB 00000000 0              0 0 2 Ffff88104fd8dd80

Look at the number "2305224138" No, it is here, we can find the link IP, Port link four tuple "8a11010a:21cd 0964010a:2227" This place is saved in hexadecimal, converted to decimal mode " 10.1.17.138:8653 10.1.100.9:8743 ";

Go to the network connection state to look inside:

[[email protected]_10_1_17_138 song_test]# netstat-ntp Active Internet Connections (w/o servers) Proto recv-q send-q Local address Foreign address State pid/progr        Am Name TCP 0 0 10.1.17.138:64428 10.1.1.156:3306 time_wait-tcp 0 0 10.1.17.138:64244 10.1.1.156:3306 time_wait-tcp 0 16 6 10.1.17.138:8653 10.1.100.9:8743 established 25465/./INDEX_SEARC TCP 0 0 10.1.17.138:           64394 10.1.1.156:3306 time_wait-tcp 0 0 10.1.17.138:29669 10.1.17.69:80 time_wait-tcp 0 0 10.1.17.138:46336 10.1.17.68: Time_wait-tcp 0 0:: ffff:10.1.17.138:8080:: ffff:10.1.17.136:27 247 Time_wait-

Back to the beginning of the question: the 101 socket file descriptor represents a TCP connection to the local "10.1.17.138:8653" to "10.1.100.9:8743"!

Find connection status with socket file descriptor under Linux system