I have an ultra old (don't ask why) BusyBox (BusyBox v1.01 (2008.12.19-21:31+0000) Built-in shell (ash)) on my DreamBox. I would like to find out which process opened which connection using netstat. But I found out that BusyBox's netstat doesn't contain the -p option. What other possibilites do I have to find out which process has opened (and is using) the corresponding socket?
You can find the equivalent information in slightly uglier form (a.k.a. hexadecimal) in
/proc/net/tcp. There, you can find the inode of the connection, which you can look up under
$ cat /proc/net/tcp sl local_address rem_address st tx_queue rx_queue tr tm->when retrnsmt uid timeout inode 0: 00000000:0016 00000000:0000 0A 00000000:00000000 00:00000000 00000000 0 0 6115 1 f5adc4c0 300 0 0 2 -1 ...
(In normal netstat, but not in busybox netstat, the
-e option also gives you that extra information.)
$ sudo ls -l /proc/2560/fd ... lrwx------ 1 root root 64 7 jan 22.50 3 -> socket:
You need root access for the second step.
Not as convenient as the
-p option, obviously, but works in a bind. Could be scripted, if necessary.
This may not help, if you don't have the opportunity to rebuild Busybox, but in case it helps anyone...
Busybox does have a configuration option to support the
-p switch of Busybox
netstat. See option
CONFIG_FEATURE_NETSTAT_PRG, selected in busybox menuconfig via Networking Utilities → netstat → Enable PID/Program name output.
If you have or can get
ss on your device it can show you the PID too:
ss -ltp # for TCP ss -lup # for UDP