lsof – Understanding ‘sock’ Lines in lsof Output

lsof

In lsof command under Ubuntu/Debian, I'm seeing a lot of lines like below:

PROGRAM 829 root  140u     sock        0,8       0t0 244182 protocol: TCP

What are these lines?

Can they be results of failed TCP connection attempts?

Best Answer

This line is displayed when lsof cannot find additional informations on the TCP socket: it knows it's a TCP socket but not more.

There are two reasons I can think of:

  • Unlikely: the socket is still not listening nor connecting: ie a server or client used for example socket(AF_INET, SOCK_STREAM, 0) to create a TCP socket but didn't call yet listen(2) or connect(2). This could be caused by lack of resources or a buggy software.

  • Most likely today: the process seen by lsof runs in an other network namespace, typically in a container (Docker, LXC, LXD ...) and thus lsof doesn't have access to the relevant information and doesn't display it.

    You should then run lsof from the same network namespace as the process. The lsns and nsenter commands can greatly help for this. For your case this would then probably work:

      nsenter -t 829 --net lsof -n -p 829

In normal cases lsof would display IPv4 or IPv6 instead of sock and would have additional informations, like listening port or addresses involved. Even a connection still ongoing would be displayed with the addresses involved and for example SYN_SENT.

Related Topic