/proc中可能的内部套接字状态列表 [英] List of possible internal socket statuses from /proc
问题描述
我想知道/proc/net/tcp中st列的可能值.我认为st列等于netstat(8)或ss(8)的STATE列.
I would like to know the possible values of st column in /proc/net/tcp. I think the st column equates to STATE column from netstat(8) or ss(8).
我设法确定了三个代码:
I have managed to identify three codes:
sl local_address rem_address st tx_queue rx_queue tr tm->when retrnsmt uid timeout inode
0: 0100007F:08A0 00000000:0000 0A 00000000:00000000 00:00000000 00000000 0 0 7321 1 ffff81002f449980 3000 0 0 2 -1
1: 00000000:006F 00000000:0000 0A 00000000:00000000 00:00000000 00000000 0 0 6656 1 ffff81003a30c080 3000 0 0 2 -1
2: 00000000:0272 00000000:0000 0A 00000000:00000000 00:00000000 00000000 0 0 6733 1 ffff81003a30c6c0 3000 0 0 2 -1
3: 0100007F:0277 00000000:0000 0A 00000000:00000000 00:00000000 00000000 0 0 7411 1 ffff81002f448d00 3000 0 0 2 -1
4: 0100007F:0019 00000000:0000 0A 00000000:00000000 00:00000000 00000000 0 0 7520 1 ffff81002f4486c0 3000 0 0 2 -1
5: 0100007F:089F 00000000:0000 0A 00000000:00000000 00:00000000 00000000 0 0 7339 1 ffff81002f449340 3000 0 0 2 -1
6: 0100007F:E753 0100007F:0016 01 00000000:00000000 02:000AFA92 00000000 500 0 18198 2 ffff81002f448080 204 40 20 2 -1
7: 0100007F:E752 0100007F:0016 06 00000000:00000000 03:000005EC 00000000 0 0 0 2 ffff81000805dc00
上面显示:
- 在sl 0行上:tcp/2208上的侦听端口.
st = 0A = LISTEN - 第sl 6行:tcp/22上已建立的会话.
st = 01 = ESTABLISHED - 第sl 7行:ssh注销后处于TIME_WAIT状态的套接字.没有索引节点.
st = 06 = TIME_WAIT
- On line sl 0: a listening port on tcp/2208.
st = 0A = LISTEN - On line sl 6: An established session on tcp/22.
st = 01 = ESTABLISHED - On line sl 7: An socket in TIME_WAIT state after ssh logout. No inode.
st = 06 = TIME_WAIT
任何人都可以在此列表上展开吗? proc(5)联机帮助页非常简洁，指出:
Can anyone expand on this list? The proc(5) manpage is quite terse on the subject stating:
/proc/net/tcp
Holds a dump of the TCP socket table. Much of the information is not of use apart from debugging. The "sl" value is the kernel hash slot for the socket, the "local address" is the local address and
port number pair. The "remote address" is the remote address and port number pair (if connected). ’St’ is the internal status of the socket. The ’tx_queue’ and ’rx_queue’ are the outgoing and incom-
ing data queue in terms of kernel memory usage. The "tr", "tm->when", and "rexmits" fields hold internal information of the kernel socket state and are only useful for debugging. The "uid" field
holds the effective UID of the creator of the socket.
在相关说明中，上面的/proc/net/tcp输出显示了一些监听过程(2208、62、111等).但是，虽然显示了已建立状态和time_wait状态，但我看不到tcp/22上正在侦听的tcp连接.是的，我可以在/proc/net/tcp6中看到它们，但是它们也应该不在/proc/net/tcp中吗? Netstat的输出显示它与仅绑定到ipv4的应用程序不同.例如
And on a related note, the above /proc/net/tcp output is showing a few listening processes (2208, 62, 111 etc). However, I cannot see a listening tcp connection on tcp/22, althought the established and time_wait states are shown. Yes, I can see them in /proc/net/tcp6 but should they not be present in /proc/net/tcp also? Netstat output shows it differently to applications bound only to ipv4. E.g.
tcp 0 0 0.0.0.0:111 0.0.0.0:* LISTEN 4231/portmap
tcp 0 0 :::22 :::* LISTEN 4556/sshd
非常感谢， -安德鲁(Andrew)
Many thanks, -Andrew
推荐答案
They should match to the enum in ./include/net/tcp_states.h in the linux kernel sources:
enum {
TCP_ESTABLISHED = 1,
TCP_SYN_SENT,
TCP_SYN_RECV,
TCP_FIN_WAIT1,
TCP_FIN_WAIT2,
TCP_TIME_WAIT,
TCP_CLOSE,
TCP_CLOSE_WAIT,
TCP_LAST_ACK,
TCP_LISTEN,
TCP_CLOSING, /* Now a valid state */
TCP_MAX_STATES /* Leave at the end! */
};
关于您的问题2.您是否真的确定没有sshd的声音，例如0.0.0.0:22吗?如果不是，我怀疑您看到的内容与v4映射到v6套接字有关，请参见例如man 7 ipv6
As for your 2. question, are you really sure there's not an sshd listening on e.g. 0.0.0.0:22 ? If not, I suspect what you're seeing is related to v4-mapped-on-v6 sockets, see e.g. man 7 ipv6
这篇关于/proc中可能的内部套接字状态列表的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！
