In lsof command under Ubuntu/Debian, I'm seeing a lot of lines like below:
PROGRAM 829 root 140u sock 0,8 0t0 244182 protocol: TCP
What are these lines?
Can they be results of failed TCP connection attempts?
This line is displayed when lsof
cannot find additional informations on the TCP socket: it knows it's a TCP socket but not more.
There are two reasons I can think of:
Unlikely: the socket is still not listening nor connecting: ie a server or client used for example socket(AF_INET, SOCK_STREAM, 0)
to create a TCP socket but didn't call yet listen(2)
or connect(2)
. This could be caused by lack of resources or a buggy software.
Most likely today: the process seen by lsof
runs in an other network namespace, typically in a container (Docker, LXC, LXD ...) and thus lsof
doesn't have access to the relevant information and doesn't display it.
You should then run lsof
from the same network namespace as the process. The lsns
and nsenter
commands can greatly help for this. For your case this would then probably work:
nsenter -t 829 --net lsof -n -p 829
In normal cases lsof
would display IPv4
or IPv6
instead of sock
and would have additional informations, like listening port or addresses involved. Even a connection still ongoing would be displayed with the addresses involved and for example SYN_SENT
.