search

lsof-org / lsof

LiSt Open Files
https://lsof.readthedocs.io
Other
423 stars 106 forks source link

[FEATURE] UDP connection status display #287

Open TouchOdeath opened 1 year ago

TouchOdeath commented 1 year ago

Is your feature request related to a problem? Please describe. TCP results will say whether the connection is ESTABLISHED, LISTEN, etc. UDP will not. At first glance, I thought there was a bug with lsof. After careful inspection, I realized its probably just a display discrepancy.

Describe the solution you'd like UDP results need to mimic how TCP results are displayed as far as connection status.

Describe alternatives you've considered Use netstat instead of lsof

Additional context lsof TCP example: command: lsof -nPi | grep TCP results:
httpd 54175 user1234 9u IPv6 34820 0t0 TCP *:443 (LISTEN) httpd 54175 user1234 21u IPv6 22049696 0t0 TCP 127.0.0.1:443->127.0.0.1:55212 (ESTABLISHED)

lsof UDP example: command: lsof -nPi | grep UDP results: NetworkMa 734 user1234 25u IPv4 20544929 0t0 UDP 10.0.2.15:68->10.0.2.2:67

netstat UDP example: command: netstat -an | grep udp results: udp 0 0 10.0.2.15:68 10.0.2.2:67 ESTABLISHED

jiegec commented 1 year ago

From the protocol perspective UDP is connectionless. From the socket perspective, UDP can be Bound or Unbound. Which OS are you using?

TouchOdeath commented 1 year ago

RHEL8. Why would netstat choose to say 'ESTABLISHED' for their UDP? lsof does specify if its connected (->), and its easy to miss. Thanks for the reply.

cloud-account commented 1 year ago

Hello,

What TouchOdeath refers to is probably known as "connected" UDP:

https://man7.org/linux/man-pages/man7/udp.7.html "When connect(2) is called on the socket, the default destination address is set and datagrams can now be sent using send(2) or write(2) without specifying a destination address. It is still possible to send to other destinations by passing an address to sendto(2) or sendmsg(2)."

https://man7.org/linux/man-pages/man2/connect.2.html "If the socket sockfd is of type SOCK_DGRAM, then addr is the address to which datagrams are sent by default, and the only address from which datagrams are received."

Such UDP connections are displayed as ESTABLISHED by tools like netstat or ss.

Regards.