sockstat / netstat output 8.x vs 7.x

[Mike Tancsa]

At 04:24 PM 5/11/2010, Julian Elischer wrote:
>On 5/11/10 12:20 PM, Wes Peters wrote:
>>The output header is instructive:
>>
>>USER     COMMAND    PID   FD PROTO  LOCAL ADDRESS         FOREIGN ADDRESS
>>www      httpd      18423 3  tcp4 6 *:80                  *:*
>>www      httpd      18423 4  tcp4   *:*                   *:*
>>www      httpd      25184 3  tcp4 6 *:80                  *:*
>>www      httpd      25184 4  tcp4   *:*                   *:*
>>
>>Same as 7, it's the foreign address.  This is normally only useful for
>>connected sockets.
>>
>>On Tue, May 11, 2010 at 11:14 AM, Mike Tancsa<mike at sentex.net>  wrote:
>>>[trying on freebsd-net since no response on stable]
>>>
>>>I noticed that apache on RELENG_8 and RELENG_7 shows up with output I cant
>>>seem to understand from sockstat -l and netstat -naW
>>>
>>>On RELENG_7, sockstat -l makes sense to me
>>>....
>>>www      httpd      83005 4  tcp4   *:443                 *:*
>>>www      httpd      82217 3  tcp4   *:80                  *:*
>>>www      httpd      82217 4  tcp4   *:443                 *:*
>>>www      httpd      38942 3  tcp4   *:80                  *:*
>>>www      httpd      38942 4  tcp4   *:443                 *:*
>>>root     httpd      1169  3  tcp4   *:80                  *:*
>>>root     httpd      1169  4  tcp4   *:443                 *:*
>>>
>>>
>>>various processes listening on all bound IP addresses on ports 80 and 443.
>>>
>>>On  RELENG_8 however, it shows up with an extra entry (at the end)
>>>
>>>www      httpd      29005 4  tcp4   *:*                   *:*
>>>www      httpd      29004 3  tcp4 6 *:80                  *:*
>>>www      httpd      29004 4  tcp4   *:*                   *:*
>>>www      httpd      29003 3  tcp4 6 *:80                  *:*
>>>www      httpd      29003 4  tcp4   *:*                   *:*
>>>www      httpd      66731 3  tcp4 6 *:80                  *:*
>>>www      httpd      66731 4  tcp4   *:*                   *:*
>>>root     httpd      72197 3  tcp4 6 *:80                  *:*
>>>root     httpd      72197 4  tcp4   *:*                   *:*
>>>
>>>
>>>*:80 makes sense to me... process is listening on all IPs for port 80.  What
>>>does *:* mean then ?
>
>I believe it has created a socket but not used it for anything
>it may be the 6 socket... otherwise I don't see what a "tcp4 6" is 
>meant to be.

Should not sockstat and netstat agree ? one says closed, the other not

         ---Mike




>>>Netstat gives a slightly different version of it
>>>
>>>Active Internet connections (including servers)
>>>Proto Recv-Q Send-Q  Local Address          Foreign Address       (state)
>>>tcp4       0      0 *.1984                 *.*                    LISTEN
>>>tcp4       0      0 *.*                    *.*                    CLOSED
>>>tcp46      0      0 *.80                   *.*                    LISTEN
>>>
>>>state closed ?
>>>
>>>         ---Mike
>>>
>>>
>>>
>>>--------------------------------------------------------------------
>>>Mike Tancsa,                                      tel +1 519 651 3400
>>>Sentex Communications,                            mike at sentex.net
>>>Providing Internet since 1994                    www.sentex.net
>>>Cambridge, Ontario Canada                         www.sentex.net/mike
>>>
>>>_______________________________________________
>>>freebsd-net at freebsd.org mailing list
>>>http://lists.freebsd.org/mailman/listinfo/freebsd-net
>>>To unsubscribe, send any mail to "freebsd-net-unsubscribe at freebsd.org"
>>
>>

--------------------------------------------------------------------
Mike Tancsa,                                      tel +1 519 651 3400
Sentex Communications,                            mike at sentex.net
Providing Internet since 1994                    www.sentex.net
Cambridge, Ontario Canada                         www.sentex.net/mike