5

I'm currently writing a script pulling data from /proc/net/tcp and /proc/net/udp and I need to translate the connection states from their hex code into something meaningful.

Example content:

  sl  local_address rem_address   st tx_queue rx_queue tr tm->when retrnsmt   uid  timeout inode ref pointer drops
  37: 00000000:2710 00000000:0000 07 00000000:00000000 00:00000000 00000000     0        0 862948 2 ffff8800109dbac0 0
  54: 00000000:00A1 00000000:0000 07 00000000:00000000 00:00000000 00000000     0        0 2055110 2 ffff8800109db780 0

So far I've turned up this answer which pointed me to the relevant kernel header file, but there is not a matching udp_states.h or anything in udp.h or ip.h.

Where can I find a list of connection states for UDP sockets?

Community
  • 1
  • 1
Sammitch
  • 30,782
  • 7
  • 50
  • 77

2 Answers2

6

UDP 'connections' are stateless. From the iptables manual:

UDP connections are in themselves not stateful connections, but rather stateless. There are several reasons why, mainly because they don't contain any connection establishment or connection closing; most of all they lack sequencing. Receiving two UDP datagrams in a specific order does not say anything about the order in which they were sent. It is, however, still possible to set states on the connections within the kernel.

See this udp programming tutorial which also helps explain why a command like ss -ua shows an udp server socket as UNCONN (aka CLOSE for tcp connections).

To sum up, I do believe the udp 'states' shown in /proc/net are recycled from tcp connection states, but they have a slightly different meaning.

Eugene Ryabtsev
  • 2,232
  • 1
  • 23
  • 37
mx1up
  • 724
  • 9
  • 15
4

On the Xubuntu I am currently looking at these states are in

/usr/src/linux-headers-3.13.0-24/include/net/tcp_states.h

You might find that UDP just reuses the same enumeration, take a look inside of /usr/src/linux/net/ipv4/udp.c and look for usages of sk_state.

The function udp4_format_sock() actually produces the output you are looking at.

Toby Speight
  • 27,591
  • 48
  • 66
  • 103
6EQUJ5
  • 3,142
  • 1
  • 21
  • 29
  • 3
    That *seems* to be the case, but it still doesn't make sense to me since `07` translates to `TCP_CLOSE`. – Sammitch May 23 '14 at 22:00
  • @6EQUJ5, could please include the link to the code path from Xubuntu. Thanks. https://github.com/torvalds/linux/blob/master/net/ipv4/udp.c – txs May 13 '21 at 20:51