/proc/net/tcp information drop



Hello everyone (yes, i´m new at this list, just correct me if i´m wrong),

I have some trouble with /proc/net/tcp and tcp6
I´m not sure if it?s a feature or a bug or maybe some cleanup of the
cache...

A long time After a connection has been established the information about
the process name and the pid itself gets lost, just a - appears.
My own network-monitoring tool uses netstat to get some information about
the network-connections. But without the pid I can't see (I could over a few
more corners but ... crap) if there are more programs at the same pid or
even which program it is (maybe an undetected Trojan or just an user with
more connections then allowed...)
Here's a link to the netstat output
http://netstat.root24.eu/netstat.php?dump=1
And to my connection-statistics (the red colored hosts/ips have no special
meaning/ just shows unresolved/new connections)
http://netstat.root24.eu/connmon.php
Normal there is a Pid and prog name in every line... since the server is
online for about a month and some connections are even so long you can see
some 'holes'

Greetings
Jörg

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/



Relevant Pages

  • Re: Strange Client Behavior: Port 8002 Looking for Other Ports
    ... connections and the PID of each process involved in the connections ... the Process with the corresponding PID. ... > periods each day, this client, which is behind Microsoft Proxy ... > connections from source port 8002 to successive ports on our DNS ...
    (microsoft.public.win2000.networking)
  • Re: Strange Client Behavior: Port 8002 Looking for Other Ports
    ... connections and the PID of each process involved in the connections ... the Process with the corresponding PID. ... > periods each day, this client, which is behind Microsoft Proxy ... > connections from source port 8002 to successive ports on our DNS ...
    (microsoft.public.win2000.security)
  • Re: Dropping sockets to a particular port
    ... Why not just deactivate the interface the connections are received on ... > That would kill my notes server unfortunately. ... > controlled by one PID and that PID is the notes server, ... > using a particular port. ...
    (AIX-L)
  • Re: New Gateway 610XL With Media Center Edition Clogging Internet
    ... In the far right column you will see Process ID's - PID. ... Task Manager using CTRL-ALT-DEL and go to the Process tab. ... "ESTABLISHED" to see which programs have connections. ... Microsoft MVP - Mobile Devices www.pocketpc.com ...
    (microsoft.public.windows.mediacenter)
  • Re: what does backlog parameter to listen do?
    ... Michael Kerrisk wrote: ... >>Do you mean ESTABLISHED state from netstat output? ... connections can't be in ESTABLISHED state until you call accept. ... Konstantin Sorokin ...
    (comp.os.linux.development.apps)