UNIX for Dummies Questions & Answers

Hi,

Is there any way i can know the association between sockets and the processes which created them.

You can look at the man page for netstat and then get the program lsof. These together should be able to give you what you are looking for.

See this thread for more info.

Where i can get the lsof utility. I want it to use for HP-UX 11 machine. I found one lsof utility in HP-UX10.2 machine,copied to HP-UX 11. It gives a warning that lsof was compiled for HP-UX 10.2

then it gives an error,can't read namelist frm /stand/vmunix

Can I get the source code for this utility??

If you also use solaris, you can get the package from:

http://www.sunfreeware.com/

Example of use lsof:

You can schedulle the data collection in your crontab:

0,5,10,15,20,25,30,35,40,45,50,55 * * * * /usr/local/scripts/reports/lsof_TCP.sh 1>/dev/null

Code:

### Begin of  lsof_TCP.sh

#!/bin/ksh
wdate=`date +"%Y%m%d"`
whour=`date +"%H:%M"`
HDIR=/usr/local/scripts/reports

detailed_lsof="/var/reports/"$wdate"/"$wdate"_detailed_lsof.txt"
brief_lsof="/var/reports/"$wdate"/"$wdate"_brief_lsof.txt"

if [ ! -d /var/reports ]
then
   mkdir /var/reports
fi

if [ ! -d /var/reports/$wdate ]
then
   mkdir /var/reports/$wdate
fi

if [ ! -f $brief_lsof ]
then
    echo "Hour , TCP_State , connections_number " >> $brief_lsof
fi

if [ ! -f $detailed_lsof ]
then
    echo "HOUR, COMMAND, PID, CONN_SRC, PORT_SRC, CONN_DST, CONN_PORT  , STATE"
>> $detailed_lsof
fi

/usr/local/bin/lsof -i TCP |grep -v "COMMAND" |nawk -v wfecha="$wdate" -v whora=
"$whour" -f  $HDIR/lsof_TCP.nawk

### End of  lsof_TCP.sh

Code:

## Begin of lsof_TCP.nawk

detailed_lsof="/var/reports/"wfecha"/"wfecha"_detailed_lsof.txt"
brief_lsof="/var/reports/"wfecha"/"wfecha"_brief_lsof.txt"
( $10 !~ "LISTEN"  && $10 !~ "IDLE" ) {
split($9,conn, "->")
split( conn[1], conn_src ,":" )
split( conn[2], conn_dst ,":" )
conn_state[$10]++
print whora", " $1", " $2", "conn_src[1]" , " conn_src[2]", " conn_dst[1]", " conn_dst[2]", " substr($1
0,2,length($10)-2) >> detailed_lsof
}END {
for (cstate in conn_state) {print whora", " substr(cstate, 2,length(cstate)-2 ) ", ",conn_state[cstate] >> brief_lsof }
}

## End of lsof_TCP.nawk

Ouput example:

::::::::::::::
20030806_brief_lsof.txt
::::::::::::::
20:10, ESTABLISHED, 372
20:10, CLOSE_WAIT, 392
20:10, BOUND, 9

::::::::::::::
20030630_detailed_lsof.txt
::::::::::::::
20:10, Xvnc, 646, localhost , 6001, localhost, 42235, CLOSE_WAIT
20:10, Xvnc, 646, localhost , 6001, localhost, 34575, CLOSE_WAIT
20:10, Xvnc, 646, localhost , 6001, localhost, 46259, CLOSE_WAIT
20:10, Xvnc, 646, localhost , 6001, localhost, 39321, ESTABLISHED
20:10, opmn, 12127, www.adomain.com , 36657, www.adomain.com, 80, ESTABLISHED
20:10, opmn, 12127, www.adomain.com , 6202, www.adomain.com, 33587, ESTABLISHED
20:10, opmn, 12127, localhost , 6102, localhost, 39089, ESTABLISHED
20:10, opmn, 12127, localhost , 6102, localhost, 39165, ESTABLISHED
20:10, opmn, 12127, localhost , 6102, localhost, 39244, ESTABLISHED
20:10, opmn, 12127, localhost , 6102, localhost, 39237, ESTABLISHED
20:10, opmn, 12127, localhost , 6102, localhost, 39243, ESTABLISHED
20:10, opmn, 12127, localhost , 6102, localhost, 39249, ESTABLISHED
20:10, opmn, 12127, localhost , 6102, localhost, 39250, ESTABLISHED
20:10, opmn, 12144, localhost , 6100, localhost, 39094, ESTABLISHED
20:10, opmn, 12144, www.adomain.com , 36415, www.adomain.com, 7777, ESTABLISHED
20:10, opmn, 12144, www.adomain.com , 33587, www.adomain.com, 6202, ESTABLISHED
20:10, opmn, 12144, localhost , 6100, localhost, 39113, ESTABLISHED
20:10, opmn, 12144, localhost , 6100, localhost, 39140, ESTABLISHED
20:10, httpd, 14022, www.adomain.com , 39286, www.adomain.com, 3004, ESTABLISHED
20:10, httpd, 14022, www.adomain.com , 41840, www.adomain.com, 3002, ESTABLISHED
20:10, httpd, 14022, www.adomain.com , 41841, www.adomain.com, 3003, ESTABLISHED
20:10, httpd, 14022, www.adomain.com , 41842, www.adomain.com, 3005, ESTABLISHED
20:10, httpd, 14022, www.adomain.com , 41843, www.adomain.com, 3004, ESTABLISHED
20:10, httpd, 14022, www.adomain.com , 41845, www.adomain.com, 3000, ESTABLISHED
20:10, httpd, 14022, www.adomain.com , 46546, www.adomain.com, 3002, ESTABLISHED
20:10, oracle, 18140, www.adomain.com , 1521, www.adomain.com, 48801, ESTABLISHED
20:10, oracle, 18142, www.adomain.com , 1521, www.adomain.com, 48802, ESTABLISHED
20:10, httpd, 23814, www.adomain.com , 64650, www.adomain.com, 3001, ESTABLISHED
20:10, oracle, 23877, www.adomain.com , 1521, www.adomain.com, 60788, ESTABLISHED
20:10, oracle, 23879, www.adomain.com , 1521, www.adomain.com, 60789, ESTABLISHED
20:10, oracle, 23881, www.adomain.com , 1521, www.adomain.com, 60790, ESTABLISHED
20:10, httpd, 23888, www.adomain.com , 35680, www.adomain.com, 3001, ESTABLISHED
20:10, oracle, 24072, www.adomain.com , 1521, www.adomain.com, 61219, ESTABLISHED
20:10, dis51ws, 24073, localhost , 61225, localhost, 39271, ESTABLISHED
20:10, dis51ws, 24073, www.adomain.com , 61224, www.adomain.com, 61226, ESTABLISHED
20:10, dis51ws, 24073, www.adomain.com , 33335, aserver7.so.ded.ba1, 1521, ESTABLISHED

added code tags for readability --oombera

Purdue has it under B.11.11 in binary only

And Asknet also has it (source and binary) or hpux.connect.org.uk which seems to be a different version of lsof but at the same site.

Quick search on the 'Net will find you more that you can decide if you want it from there.