netstat -ntap doesn't show pid/process name for some connections?
I have ubuntu/hardy server, with kernel 2.6.24-23-server and netstat:
# netstat --version
net-tools 1.60
netstat 1.42 (2001-04-15)
The problem is that we have a lot of ESTABLISHED connections that don't show PID nor Program name in netstat -ntap
output. Netstat was called from root, there are no chroots, grsecurity, nor anything like this (or so I was told :).
Any idea on what might be wrong?
UPDATE
lsof -n -i
works ok, and shows pid/process name for the connections.
198_141:~ # netstat -anp|grep 33000
tcp 0 0 0.0.0.0:53000 0.0.0.0:* LISTEN -
198_141:~ # lsof -i:33000
COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME
vsftpd 28147 root 3u IPv4 4089990174 TCP *:33000 (LISTEN)
198_141:~ # id
uid=0(root) gid=100(users) groups=16(dialout),100(users)
198_141:~ #
in my oninion,there could be two situations:
1) normal privilege user excute "netstat" cann't see those processes launched by root
2) some processes run in kernel
This will occur with kernel processes like NFS, but also occasionally occurs with regular apps: RHEL 5 has the same behaviour.
# netstat -taupen | grep 30715
tcp 0 0 0.0.0.0:30715 0.0.0.0:* LISTEN 66558 81467710 -
Note that lsof, on the other hand, words properly:
# lsof -i:30715
AppName 1598 useracct 78u IPv4 81467710 TCP *:30715 (LISTEN)
For established connections, this should only happen for connections that are initiated from kernel space, like NFS or DRBD. Obviously waiting connections could have had the process die underneath them. If you can't work out what is causing a given connection, paste the output and someone can tell you what it is.