Which thread listens to a specific UDP port

Question

I ran:

# lsof | grep 10900

And its output:

MyExecutab 103497        myuser    7u     IPv4             985833       0t0        UDP my.example.com:10900 
MyExecutab 103497 103498 myuser    7u     IPv4             985833       0t0        UDP my.example.com:10900 
MyExecutab 103497 103499 myuser    7u     IPv4             985833       0t0        UDP my.example.com:10900 
MyExecutab 103497 103500 myuser    7u     IPv4             985833       0t0        UDP my.example.com:10900 
MyExecutab 103497 103501 myuser    7u     IPv4             985833       0t0        UDP my.example.com:10900 
MyExecutab 103497 103502 myuser    7u     IPv4             985833       0t0        UDP my.example.com:10900 
MyExecutab 103497 103503 myuser    7u     IPv4             985833       0t0        UDP my.example.com:10900

I am trying to figure out which thread is reading from the UDP port 10900.

It seems like there are 7 threads reading from that port, is it true?

I feel that only one thread is actually reading but lsof just listed all child threads (within the same process) and the parent thread.

netstat -plun shows that only the parent thread (PID) is listening to that port:

Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name    
udp        0      0 10.7.168.173:10900      0.0.0.0:*                           103497/MyExecutable

I also checked /proc/[pid]/fd. Because only 103497 is a PID, the rest are TID, so /proc/ only has 103497 but not the rest.

So is there really a way to figure out which thread listens to a specific UDP port?

I am on CentOS 7 (kernel 3.10).

Thanks!

Any number of threads can call `recvfrom/sendto` on the same UDP socket. — Maxim Egorushkin, Oct 10 '18 at 13:53

score 3 · Accepted Answer · answered Oct 10 '18 at 13:55

3

Run strace -ffp <pid> and see which threads use file descriptor 7.

answered Oct 10 '18 at 13:55

Maxim Egorushkin

131,725
17
180
271

Thanks for your reply. What does `-ff` do? Manpage says, `-ff If the -o filename option is in effect, each processes trace is written to filename.pid where pid is the numeric process id of each process. This is incompatible with -c, since no per-process counts are kept.` which doesn't really tell me much. Same as `-f`? Thanks! – HCSF Oct 11 '18 at 01:59
1

@HCSF If you try it you will see tid in front of each syscall. – Maxim Egorushkin Oct 11 '18 at 07:35

Which thread listens to a specific UDP port

1 Answers1