10

I have an ultra old (don't ask why) BusyBox (BusyBox v1.01 (2008.12.19-21:31+0000) Built-in shell (ash)) on my DreamBox. I would like to find out which process opened which connection using netstat. But I found out that BusyBox's netstat doesn't contain the -p option. What other possibilites do I have to find out which process has opened (and is using) the corresponding socket?

  • Is lsof part of that version of busybox? – Zoredache Jan 7 '11 at 21:07
  • Unfortunately not. – a1337q Jan 7 '11 at 21:10
14

You can find the equivalent information in slightly uglier form (a.k.a. hexadecimal) in /proc/net/tcp. There, you can find the inode of the connection, which you can look up under /proc/$pid/fd/.

For example:

$ cat /proc/net/tcp
sl  local_address rem_address   st tx_queue rx_queue tr tm->when retrnsmt   uid  timeout inode
 0: 00000000:0016 00000000:0000 0A 00000000:00000000 00:00000000 00000000     0        0 6115 1 f5adc4c0 300 0 0 2 -1
...

(In normal netstat, but not in busybox netstat, the -e option also gives you that extra information.)

and

$ sudo ls -l /proc/2560/fd
...
lrwx------ 1 root root 64  7 jan 22.50 3 -> socket:[6115]

You need root access for the second step.

Not as convenient as the -p option, obviously, but works in a bind. Could be scripted, if necessary.

  • Sounds cool, but my netstat doesn't work as it should, it outputs nothing additional with the -e option. I have 6 columns also with -e: Proto, Recv-Q, Send-Q, Local Address, Foreign Address, State. Is there a way with the ports? I can see the port.. – a1337q Jan 7 '11 at 21:05
  • You're right, I must have messed up my tests. I edited it to give you a working solution. – Peter Eisentraut Jan 8 '11 at 8:39
  • How do you find the number "2560" you type in your second command? That's the question. – ygoe Mar 22 at 11:17
  • @ygoe you have to use 6115 and use it like this: find /proc/ -type l | grep /fd/ | xargs ls -la 2>/dev/null | grep 6115 – Sam Jun 27 at 12:44
3

This may not help, if you don't have the opportunity to rebuild Busybox, but in case it helps anyone...

Busybox does have a configuration option to support the -p switch of Busybox netstat. See option CONFIG_FEATURE_NETSTAT_PRG, selected in busybox menuconfig via Networking Utilities → netstat → Enable PID/Program name output.

0

If you have or can get ss on your device it can show you the PID too:

ss -ltp # for TCP
ss -lup # for UDP

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.