Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- Decoding the data in /proc/net/tcp:
- Linux 5.x /proc/net/tcp
- Linux 6.x /proc/PID/net/tcp
- Given a socket:
- $ ls -l /proc/24784/fd/11
- lrwx------ 1 jkstill dba 64 Dec 4 16:22 /proc/24784/fd/11 -> socket:[15907701]
- Find the address
- $ head -1 /proc/24784/net/tcp; grep 15907701 /proc/24784/net/tcp
- sl local_address rem_address st tx_queue rx_queue tr tm->when retrnsmt uid timeout inode
- 46: 010310AC:9C4C 030310AC:1770 01 0100000150:00000000 01:00000019 00000000 1000 0 54165785 4 cd1e6040 25 4 27 3 -1
- 46: 010310AC:9C4C 030310AC:1770 01
- | | | | | |--> connection state
- | | | | |------> remote TCP port number
- | | | |-------------> remote IPv4 address
- | | |--------------------> local TCP port number
- | |---------------------------> local IPv4 address
- |----------------------------------> number of entry
- 00000150:00000000 01:00000019 00000000
- | | | | |--> number of unrecovered RTO timeouts
- | | | |----------> number of jiffies until timer expires
- | | |----------------> timer_active (see below)
- | |----------------------> receive-queue
- |-------------------------------> transmit-queue
- 1000 0 54165785 4 cd1e6040 25 4 27 3 -1
- | | | | | | | | | |--> slow start size threshold,
- | | | | | | | | | or -1 if the treshold
- | | | | | | | | | is >= 0xFFFF
- | | | | | | | | |----> sending congestion window
- | | | | | | | |-------> (ack.quick<<1)|ack.pingpong
- | | | | | | |---------> Predicted tick of soft clock
- | | | | | | (delayed ACK control data)
- | | | | | |------------> retransmit timeout
- | | | | |------------------> location of socket in memory
- | | | |-----------------------> socket reference count
- | | |-----------------------------> inode
- | |----------------------------------> unanswered 0-window probes
- |---------------------------------------------> uid
- timer_active:
- 0 no timer is pending
- 1 retransmit-timer is pending
- 2 another timer (e.g. delayed ack or keepalive) is pending
- 3 this is a socket in TIME_WAIT state. Not all field will contain data.
- 4 zero window probe timer is pending
- ==========================================
- Perl script to decode the address
- #!/usr/bin/perl
- my $hexip=$ARGV[0];
- my $hexport=$ARGV[1];
- print "hex: $hexip\n";
- my @ip = map hex($_), ( $hexip =~ m/../g );
- my $ip = join('.',reverse(@ip));
- my $port = hex($hexport);
- print "IP: $ip PORT: $port\n";
- ==========================================
- $ hexip.pl 030310AC 1770
- hex: 030310AC
- IP: 172.16.3.3 PORT: 6000
Add Comment
Please, Sign In to add comment