tracing ports open by kernel modules

Cliff Woolley (JWOOLLEY@wlu.edu)
Thu, 05 Aug 1999 03:19:31 -0400

Here's something that's come up in the linux-admin channel that I
haven't yet gotten a good answer to. I'm writing a perl script to audit
the IP ports that are open on a machine, giving the name of the service
(if it's available) and, more importantly, the name of the program that
has the port open. That's fairly straightforward (information from
fuser, rpcinfo, /etc/inetd.conf, etc).

The only part I haven't figured out is for ports open by the kernel.
Where can I get the type of information that fuser will return for user
processes for these modules? Take kernel-based NFS as an example... it
seems to show up with its own PID, and I can make a fairly educated
guess that 800/udp maps to it, but that's not exactly definitive.

Checking the /proc/<pid> information for that process yields
virtually nil. Is there are reason for this? What would it take to
have the file descriptors in use by kernel modules be reflected in their
/proc entry just as they would be for a userspace process, in which case
fuser would probably pick these processes up right along with the
others?

Thanks,
-Cliff

Cliff Woolley
Central Systems Software Administrator
Washington and Lee University
http://www.wlu.edu/~jwoolley/

Work: (540) 463-8089
Pager: (540) 462-3472

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/