0

on one of my linux hosts, one tcp socket seems to be visible on one side and invisble on the other side. I mean netstat displays this socket when I am on one of the hosts and not when I am on the other (linux too):

# netstat -anp|grep 37674
udp        0      0 169.254.192.2:37674         169.254.192.1:8649          ESTABLISHED 22644/xxxxx
# ssh 169.254.192.1
Last login: Mon Jan 13 15:22:54 CET 2014 from xxxxxx on ssh
# netstat -anp|grep 8649
#

If I undestand correctly, netstat reads connections from /proc/net/tcp. Apparently, local ip address and ports are given as 0123ABCD:1234 in /proc/net/tcp in second column.

37674(10) = 932A(16)

Thus, I tried to find 932A in /proc/net/tcp, ignoring case but found nothing.

IP address is not truncated as I have no other 169.254.192.1xx host on my network.

This connection is still visible after three hours, thus I don't think it's timeout related.

yohann.martineau
  • 1,523
  • 1
  • 17
  • 24

1 Answers1

1

The output of netstat says UDP. (Look in /proc/net/udp)

This means means 169.254.192.2 has called connect() to 169.254.192.1:8649. UDP is however connectionless, so this info is just recorded locally on a socket on the 169.254.192.2 machine.

Calling connect() on an UDP socket just enables you to call send() on that socket without specifying the destination address for each packet with sendto()/sendmsg() - no actual connection created between the two machines.

If the 169.254.192.1 machine isn't listening/receiving packets on port 8649, it isn't meaningful for the 169.254.192.1 machine to set up a socket that can send packets there though.

nos
  • 223,662
  • 58
  • 417
  • 506
  • 63: 02C0FEA9:932A 01C0FEA9:21C9 01 00000000:00000000 00:00000000 00000000 0 0 1409684718 2 ffff880c2364a880 0 – yohann.martineau Jan 13 '14 at 15:03
  • you're right... I was sure it was a tcp connection, sorry... (I think I need to sleep...) Thanks! – yohann.martineau Jan 13 '14 at 15:03
  • nevertheless, I have another connection with the following status on host a: – yohann.martineau Jan 14 '14 at 09:33
  • nevertheless, I have another connection with the following status on host a: tcp 0 0 ::ffff:169.254.200.2:30113 ::ffff:169.254.200.1:55816 ESTABLISHED 21719/xxxxxxx and invisible on host b "netstat -anp |grep 55816" returns nothing on 169.254.200.1 – yohann.martineau Jan 14 '14 at 09:35
  • 1
    @yohann.martineau It might happen if the TCP connection is idle, and 169.254.200.1 got power-cycled or similar. If nothing is writing to the TCP connection, 169.254.200.2 will never know is gone. – nos Jan 14 '14 at 10:26
  • yes, I think that's what happened but I thought tcp connection would fall if remote host was rebooted. – yohann.martineau Jan 14 '14 at 10:40
  • @yohann.martineau If there's no data being sent on the connection, and you pull out the ether net cable, or power cable of the other end, there's nothing telling TCP that the connection is down. You'll discover that fact if you try to write on the connection though (or enable TCP keepalives) – nos Jan 14 '14 at 11:53