我想知道stin 中column 的可能值/proc/net/tcp。我认为该st列等于netstat(8)或中的STATE列ss(8)。
st
/proc/net/tcp
netstat(8)
ss(8)
我设法确定了三个代码:
sl local_address rem_address st tx_queue rx_queue tr tm->when retrnsmt uid timeout inode 0: 0100007F:08A0 00000000:0000 0A 00000000:00000000 00:00000000 00000000 0 0 7321 1 ffff81002f449980 3000 0 0 2 -1 1: 00000000:006F 00000000:0000 0A 00000000:00000000 00:00000000 00000000 0 0 6656 1 ffff81003a30c080 3000 0 0 2 -1 2: 00000000:0272 00000000:0000 0A 00000000:00000000 00:00000000 00000000 0 0 6733 1 ffff81003a30c6c0 3000 0 0 2 -1 3: 0100007F:0277 00000000:0000 0A 00000000:00000000 00:00000000 00000000 0 0 7411 1 ffff81002f448d00 3000 0 0 2 -1 4: 0100007F:0019 00000000:0000 0A 00000000:00000000 00:00000000 00000000 0 0 7520 1 ffff81002f4486c0 3000 0 0 2 -1 5: 0100007F:089F 00000000:0000 0A 00000000:00000000 00:00000000 00000000 0 0 7339 1 ffff81002f449340 3000 0 0 2 -1 6: 0100007F:E753 0100007F:0016 01 00000000:00000000 02:000AFA92 00000000 500 0 18198 2 ffff81002f448080 204 40 20 2 -1 7: 0100007F:E752 0100007F:0016 06 00000000:00000000 03:000005EC 00000000 0 0 0 2 ffff81000805dc00
以上显示:
st = 0A = LISTEN
st = 01 = ESTABLISHED
st = 06 = TIME_WAIT
任何人都可以在此列表上展开吗?该手册proc(5)的主题很简洁:
proc(5)
/proc/net/tcp Holds a dump of the TCP socket table. Much of the information is not of use apart from debugging. The "sl" value is the kernel hash slot for the socket, the "local address" is the local address and port number pair. The "remote address" is the remote address and port number pair (if connected). ’St’ is the internal status of the socket. The ’tx_queue’ and ’rx_queue’ are the outgoing and incom- ing data queue in terms of kernel memory usage. The "tr", "tm->when", and "rexmits" fields hold internal information of the kernel socket state and are only useful for debugging. The "uid" field holds the effective UID of the creator of the socket.
与此相关的是,上面的/ proc / net / tcp输出显示了一些监听过程(2208、62、111等)。但是,虽然显示了已建立状态和time_wait状态,但我看不到tcp / 22上正在侦听的tcp连接。是的,我可以在里面看到它们,/proc/net/tcp6但也应该不在/proc/net/tcp吗?Netstat的输出显示它与仅绑定到ipv4的应用程序不同。例如
/proc/net/tcp6
tcp 0 0 0.0.0.0:111 0.0.0.0:* LISTEN 4231/portmap tcp 0 0 :::22 :::* LISTEN 4556/sshd
非常感谢,-安德鲁
它们应与linux内核源代码中./include/net/tcp_states.h中的枚举匹配 :
enum { TCP_ESTABLISHED = 1, TCP_SYN_SENT, TCP_SYN_RECV, TCP_FIN_WAIT1, TCP_FIN_WAIT2, TCP_TIME_WAIT, TCP_CLOSE, TCP_CLOSE_WAIT, TCP_LAST_ACK, TCP_LISTEN, TCP_CLOSING, /* Now a valid state */ TCP_MAX_STATES /* Leave at the end! */ };
至于您的2.问题,您是否真的确定没有使用sshd监听例如0.0.0.0:22?如果不是,我怀疑您看到的内容与v4映射到v6套接字有关,请参见例如man 7 ipv6
man 7 ipv6