netstat -ntap doesn't show pid/process name for some connections?

I have ubuntu/hardy server, with kernel 2.6.24-23-server and netstat:

# netstat --version
net-tools 1.60
netstat 1.42 (2001-04-15)

The problem is that we have a lot of ESTABLISHED connections that don't show PID nor Program name in netstat -ntap output. Netstat was called from root, there are no chroots, grsecurity, nor anything like this (or so I was told :).

Any idea on what might be wrong?

UPDATE

lsof -n -i works ok, and shows pid/process name for the connections.


198_141:~ # netstat  -anp|grep 33000
tcp        0      0 0.0.0.0:53000           0.0.0.0:*               LISTEN       -                   
198_141:~ # lsof -i:33000
COMMAND   PID USER   FD   TYPE     DEVICE SIZE NODE NAME
vsftpd  28147 root    3u  IPv4 4089990174       TCP *:33000 (LISTEN)
198_141:~ # id
uid=0(root) gid=100(users) groups=16(dialout),100(users)
198_141:~ # 

in my oninion,there could be two situations:

1) normal privilege user excute "netstat" cann't see those processes launched by root

2) some processes run in kernel


This will occur with kernel processes like NFS, but also occasionally occurs with regular apps: RHEL 5 has the same behaviour.

# netstat -taupen | grep 30715
tcp        0      0 0.0.0.0:30715           0.0.0.0:*               LISTEN      66558      81467710   - 

Note that lsof, on the other hand, words properly:

# lsof -i:30715
AppName 1598 useracct   78u     IPv4           81467710                   TCP *:30715 (LISTEN)

For established connections, this should only happen for connections that are initiated from kernel space, like NFS or DRBD. Obviously waiting connections could have had the process die underneath them. If you can't work out what is causing a given connection, paste the output and someone can tell you what it is.