On Sat, Jul 01, 2017 at 08:50:36PM +0200, Sebastian Benoit wrote:
> @@ -149,7 +149,7 @@ protopr(kvm_t *kvmd, u_long pcbaddr, u_int tableid, int
> proto)
> struct kinfo_file *kf;
> int i, fcnt;
>
> - kf = kvm_getfiles(kvmd, KERN_FILE_BYFILE, DTYPE_SOCKET,
> + kf = kvm_getfiles(kvmd, KERN_FILE_BYPID, -1,
> sizeof(*kf), &fcnt);
> if (kf == NULL) {
> printf("Out of memory (file table).\n");
This will not display TCP sockets that have been closed by the
process. It is important to see them as they still allocate kernel
resources. The KERN_FILE_BYFILE sysctl loops over the PCB tables
in the kernel to make this possible.
bluhm
