RE: ESTABLISHED TCP connections missing from /proc/net/tcp

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



> -----Original Message-----
> From: linux-net-owner@xxxxxxxxxxxxxxx 
> [mailto:linux-net-owner@xxxxxxxxxxxxxxx] On Behalf Of Jeff Haran
> Sent: Tuesday, January 02, 2007 5:37 PM
> To: linux-net@xxxxxxxxxxxxxxx
> Subject: ESTABLISHED TCP connections missing from /proc/net/tcp
> 
> Hi,
> 
> I telnet to my target system running linux 2.6.14 (PowerPC 32 
> platform).
> 
> If at that time I cat /proc/net/tcp at my serial console, I 
> see no entries for the ESTABLISHED tcp connection that telnet 
> is running
> through:
> 
> FD21:root> cat /proc/net/tcp
>   sl  local_address rem_address   st tx_queue rx_queue tr tm->when
> retrnsmt   uid  timeout inode                                      
>    0: C0A84A66:0381 00000000:0000 0A 00000000:00000000 00:00000000
> 00000000     0        0 814 1 c7eb1040 300 0 0 2 -1  
>    1: 7F000001:8009 00000000:0000 0A 00000000:00000000 00:00000000
> 00000000     0        0 575 1 c7eb17c0 300 0 0 2 -1
>    2: 00000000:006F 00000000:0000 0A 00000000:00000000 00:00000000
> 00000000     0        0 195 1 c7eb1b80 300 0 0 2 -1
>    3: C0A84A66:0050 00000000:0000 0A 00000000:00000000 00:00000000
> 00000000     0        0 948 1 c7eb1400 300 0 0 2 -1
>    4: DCDCDC02:0050 00000000:0000 0A 00000000:00000000 00:00000000
> 00000000     0        0 949 1 c343cba0 300 0 0 2 -1
>    5: C0A84A66:0050 C0A84A66:0471 06 00000000:00000000 03:000000BD
> 00000000     0        0 0 2 c2fda660
> 
> Those "0A"s under "st" are listening sockets. The "06" is an 
> old connection in time wait. But no established connections 
> are shown, which I believe should be showing up as "01"s (at 
> least they do when I do the same on the PC I have Redhat running on).
> 
> netstat, which appears to derive its output from this proc 
> entry, thus shows no active connections:
> 
> FD21:root> netstat -tn
> Active Internet connections (w/o servers)
> Proto Recv-Q Send-Q Local Address           Foreign Address
> State
> FD21:root>
> 
> Any ideas as to why I am not seeing established TCP 
> connections in /proc/net/tcp?
> 

Hi all,

Just documenting the resolution of this for posterity.

It turns out that when you enable IPv6 in your kernel (like we have
here), then established IPv4 TCP connections show up under
/proc/net/tcp6 rather than /proc/net/tcp:

FD21:root> cat /proc/net/tcp6
  sl  local_address                         remote_address
st tx_queue rx_queue tr tm->when retrnsmt   uid  timeout inode
   0: 00000000000000000000000000000000:0016
00000000000000000000000000000000:0000 0A 00000000:00000000 00:00000000
00000000     0        0 395 1 c7f3e040 300 0 0 2 -1
   1: 00000000000000000000000000000000:0017
00000000000000000000000000000000:0000 0A 00000000:00000000 00:00000000
00000000     0        0 212 1 c7f3f9c0 300 0 0 2 -1
   2: 00000000000000000000FFFFC0A84A67:0017
00000000000000000000FFFFC0A82E67:05BB 01 00000002:00000000 01:00000024
00000000     0        0 1137 4 c7f3f580 37 4 1 3 100

That last line represents an IPv4 telnet connection between a PC running
XP and my target system. I've sniffed the traffic and verified that this
TCP connection is being carried in IPv4 packets not IPv6. Seems odd that
it shows up under /proc/net/tcp6, but once that is understood it seems
to work reliably.

Then you have to make sure you are running a version of netstat with
IPv6 support and make sure to add the "-v" option to prevent netstat
from truncating the IPv4 address that it will display in IPv6 form:

FD21:root> netstat -t -n
Active Internet connections (w/o servers)
Proto Recv-Q Send-Q Local Address           Foreign Address
State
tcp        0    208 ::ffff:192.168.74.10:23 ::ffff:192.168.46.:1467
ESTABLISHED
FD21:root>

FD21:root> netstat -v -t -n
Active Internet connections (w/o servers)
Proto Recv-Q Send-Q Local Address           Foreign Address
State
tcp        0      2 ::ffff:192.168.74.103:23 ::ffff:192.168.46.103:1467
ESTABLISHED
FD21:root>

Thanks for the help,

Jeff Haran
Brocade Communications Systems
-
To unsubscribe from this list: send the line "unsubscribe linux-net" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html

[Index of Archives]     [Netdev]     [Ethernet Bridging]     [Linux 802.1Q VLAN]     [Linux Wireless]     [Kernel Newbies]     [Security]     [Linux for Hams]     [Netfilter]     [Git]     [Bugtraq]     [Yosemite News and Information]     [MIPS Linux]     [ARM Linux]     [Linux RAID]     [Linux PCI]     [Linux Admin]     [Samba]

  Powered by Linux