2

From https://unix.stackexchange.com/a/485290/674

Further down in the netstat output is UNIX sockets:

Active UNIX domain sockets (servers and established)
Proto RefCnt Flags       Type       State         I-Node   PID/Program name     Path
<snip>
unix  2      [ ACC ]     STREAM     LISTENING     21936    1/systemd            /run/dbus/system_bus_socket
<snip>
unix  3      [ ]         STREAM     CONNECTED     28918    648/dbus-daemon      /run/dbus/system_bus_socket

We can see that both of these processes are using the UNIX socket at /run/dbus/system_bus_socket. So if you knew one of the processes, looking at this, you should be able to determine the other end.

Does that mean any pair of server and client processes based on Unix domain socket should appear in the output of netstat like the one above? In other words, should netstat always show both server and client processes?

GNU Screen also runs as server and client processes based on Unix domain socket, so should they appear in the output of netstat? Why does netstat in fact not show Screen client but only Screen server process like the one below,

$ sudo netstat -ap | grep -i screen 
unix  2   [ ACC ]  STREAM  LISTENING  4533106  27525/SCREEN   /run/screen/S-t/27525.test

while ps shows both?

$ ps aux | grep -i screen
t        19686  0.0  0.0  45096  3292 pts/7    S+   22:19   0:00 screen -r test
t        27525  0.0  0.0  45780  3292 ?        Ss   07:22   0:00 SCREEN -S test

Thanks.

Tim
  • 101,790

1 Answers1

3

screen processes don’t maintain socket connections while they’re running; they open and close socket connections as needed when they have messages to send. Thus, when you run screen -r to reconnect to an existing session, it connects to the existing process using a socket, negotiates various settings, and when it’s good to go, attaches to the appropriate terminal, and closes the socket.

That means that when you run netstat, unless you happen to do so exactly when two screen processes are communicating (which doesn’t happen all that often), you won’t see an open socket connecting two screen processes.

Stephen Kitt
  • 434,908
  • Thanks. (1) When a Screen client is connected to a Screen server over socket, normally we are using an interactive shell in the client. In that case, should the socket connection be on all the time? (2) "when it’s good to go, attaches to the appropriate terminal, and closes the socket." What is "the appropriate terminal", why does the client want to attach to the terminal, and does that replace the need of the socket connection? – Tim Jan 05 '19 at 15:39