Detect presence of non-connected socket that holds the port (on Linux)

Question

Test on Linux (particularly: Ubuntu 20.04 LTS, kernel 5.4.0): in Python:

from socket import *
s1 = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP)
s1.bind(('', 11001))
s2 = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP)
s2.bind(('', 11001)) ## Here it fails: EADDRINUSE

So, at the moment s1 is bound, the port use is already registered somewhere in system.

But, unless I call listen() or connect() on the socket, it won't be shown in any registry I could find. /proc/net/tcp doesn't list it, nor netstat nor ss. lsof lists it but without the port:

python3   28296                           netch    5u     sock                0,9       0t0    4311999 protocol: TCP
python3   28296                           netch    6u     sock                0,9       0t0    4312006 protocol: TCP

Only when I call listen() on the socket, it appears in visible lists:

$ ss -at | grep 11001
LISTEN 0      128            0.0.0.0:11001                0.0.0.0:*

TCP here is not a single case (originally I've faced it with SCTP, in the same manner).

To compare with, FreeBSD (tested 12.3) immediately lists the socket (checked using sockstat):

$ sockstat -P tcp -p 11001           
USER     COMMAND    PID   FD PROTO  LOCAL ADDRESS         FOREIGN ADDRESS      
netch    python3.8  797   4  tcp4   *:11001               *:*

Is there a tool to list presence of such sockets? Could it be done without iteration of all processes? Why the standard tools (like netstat, ss) ignore the issue?

Did you try this?: https://www.ibm.com/support/pages/determining-which-process-bound-specific-socketport
Or maybe this: https://unix.stackexchange.com/a/9284/258734 — Mikolaj Buchwald, May 24 '22 at 22:35
@MikolajBuchwald Checked it: the recipe is for AIX and, unfortunately, don't work on Linux. — Netch, May 25 '22 at 06:29
Damn :( Maybe this one? Seems like a similar issue: https://stackoverflow.com/questions/50849122/how-to-find-which-process-bind-a-socket-but-not-listen — Mikolaj Buchwald, May 25 '22 at 22:46
@MikolajBuchwald Yep, this is principally the same question. The answer there suggests a set of candidates for the bound socket but doesn't provide an exact one. — Netch, May 26 '22 at 06:38
Yes, but this way you don't have to iterate over all processes (your initial request), am I right? — Mikolaj Buchwald, May 27 '22 at 12:39
@MikolajBuchwald No, lsof iterates all processes. But the principal fact is that they are still candidates and there is no information to select a proper one without killing all them in line. — Netch, May 30 '22 at 06:48
Does this answer your question? How to find applications/ports that do bind() but don't do listen()? — A.B, Mar 19 '23 at 22:35
@A.B Thanks, it essentially is the same question. The recipe in answer looks really horrible and I'd like to see a simpler one, but, having a working way is nice:)) — Netch, Mar 21 '23 at 07:26

score 0 · Answer 1 · answered Mar 21 '23 at 07:29

0

Self-answer: there is a likely working recipe here, although extremely cumbersome. Thanks to @A.B for pointing in comments.

Iʼll update it if find a better solution.

answered Mar 21 '23 at 07:29

Netch

2,529

It was not just a comment: it was a query to mark the question as duplicate – A.B Mar 21 '23 at 08:36

Detect presence of non-connected socket that holds the port (on Linux)

1 Answers1