1

On Solaris (or Unix), running lsof gives me a bunch of lines like this:

java    25375 foo 8161u  IPv4 0xfffffeb1f6f523c0        0t0        TCP *:* (IDLE)

But the *:* puzzles me - I was expecting to see something like 

hostname1:port1->ipaddress:port2 (IDLE)

What does the *:* mean?

Ben Aston
  • 53,718
  • 65
  • 205
  • 331

1 Answers1

2

I will quote this from here:

If the Foreign Address is *:* (and, with TCP sockets, the state is LISTEN), a socket is usually waiting for some remote host to send the first data. Typical examples: sshd (waits for somebody to open an ssh connection), apache (waits for somebody to request a web page), cupsd (waits for somebody to send a print job), and dhclient (waits for the DHCP server to send, for example, a lease renewal).

Daniel
  • 21,933
  • 14
  • 72
  • 101
  • Ok. So the example in the question corresponds to an idle tcp connection maintained by java.exe. What does anything:anything mean in this context? Put another way; under what circumstances is a tcp connection maintained with anything:anything ? It seems like a tcp connection should be associated with a specific host – Ben Aston Dec 11 '14 at 01:03
  • No, it's not `anything:anything`. `IPv4 INADDR_ANY` and `IPv6 IN6_IS_ADDR_UNSPECIFIED` addresses, and `zero port numbers` are represented by an asterisk ('*'). – Petr Duchek Dec 11 '14 at 01:13
  • @Petr what might cause an idle `*:*` tcp socket? – Ben Aston Dec 11 '14 at 01:19
  • 1
    Yes, it's probably socket. A newly created TCP socket has no remote or local address and is not fully specified (no ports associated, ...). – Petr Duchek Dec 11 '14 at 01:31
  • You mean a "half-open" tcp connection? – Ben Aston Dec 11 '14 at 01:44
  • 1
    Not even half-open. There is actually no connection (yet) here. It is an unbound socket and Mondkin reply is irrelevant, that's not the foreign address which is `*:*` but the local one. @PetrDuchek you should make your comment a reply. – jlliagre Dec 11 '14 at 13:29
  • Why would a large number of unbound IDLE sockets be created? I have an issue with the process file descriptor limit being blown by around 7k unbound IDLE TCP connections being created. Put another way, what could result in the creation of an unbound socket? Naively, such a socket seems to be pointless. – Ben Aston Dec 11 '14 at 18:14