On Wed, Dec 16, 2020 at 05:24:50PM +0100, Claudio Jeker wrote: > On Wed, Dec 16, 2020 at 03:54:04PM +0000, Stuart Henderson wrote: > > On 2020/12/16 16:43, Salvatore Cuzzilla wrote: > > > Hi folks, > > > > > > is there any process associated with this netstat record? > > > btw, what's the meaning of the state field with value '17'? > > > > > > ToTo@obsd ~ $ doas netstat -an -f inet > > > Active Internet connections (including servers) > > > Proto Recv-Q Send-Q Local Address Foreign Address > > > (state) > > > ip 0 0 *.* *.* 17 > > > > Are kernel and userland in sync? > > This is a SOCK_RAW socket using protocol 17 (UDP). AFAIK this is dhclient. > You can see this also with fstat. > root dhclient 75024 5* internet dgram udp *:0
Should we print a specific headline in netstat to avoid such questions? Proto Recv-Q Send-Q Local Address Foreign Address IP-Proto ip 0 0 *.* *.* 17 Proto Recv-Q Send-Q Local Address Foreign Address TCP-State tcp 0 0 192.168.2.138.35130 52.10.128.80.443 ESTABLISHED Proto Recv-Q Send-Q Local Address Foreign Address udp 0 0 192.168.2.138.31411 162.159.200.1.123 ok? bluhm Index: inet.c =================================================================== RCS file: /data/mirror/openbsd/cvs/src/usr.bin/netstat/inet.c,v retrieving revision 1.168 diff -u -p -r1.168 inet.c --- inet.c 15 Jan 2020 14:02:37 -0000 1.168 +++ inet.c 23 Dec 2020 15:08:45 -0000 @@ -327,9 +327,10 @@ netdomainpr(struct kinfo_file *kf, int p if (Bflag && istcp) printf("%-6.6s %-6.6s %-6.6s ", "Recv-W", "Send-W", "Cgst-W"); - printf(" %-*.*s %-*.*s %s\n", + printf(" %-*.*s %-*.*s%s\n", addrlen, addrlen, "Local Address", - addrlen, addrlen, "Foreign Address", "(state)"); + addrlen, addrlen, "Foreign Address", + istcp ? " TCP-State" : type == SOCK_RAW ? " IP-Proto" : ""); } if (Aflag)