4
1
The last 2 lines of lsof -i are shown as below. What are those? I use OpenSuse LEAP 42.2.
Web\x20Co 7066 user1 38u IPv4 76006 0t0 UDP *:43756
Web\x20Co 7066 user1 39u IPv6 76008 0t0 UDP *:46834
4
1
The last 2 lines of lsof -i are shown as below. What are those? I use OpenSuse LEAP 42.2.
Web\x20Co 7066 user1 38u IPv4 76006 0t0 UDP *:43756
Web\x20Co 7066 user1 39u IPv6 76008 0t0 UDP *:46834
2
The \x20
string in the first column is a hexadecimal value for an ASCII character, in this case the space character. The output formatting used by lsof is described on the lsof man page.
Lsof only outputs printable (declared so by isprint(3)) 8 bit characters. Non-printable characters are printed in one of three forms: the C ``\[bfrnt]'' form; the
control character `^' form (e.g., ``^@''); or hexadecimal leading ``\x'' form (e.g., ``\xab''). Space is non-printable in the COMMAND column (``\x20'') and printable
elsewhere.
The man page describes that for the COMMAND column (shown on the left in the example output) the space character is treated as non-printable.
1
\x20
is a space.The \x20
is a space "".
The hexadecimal prefix \x
is one of the 3 ways forlsof
to print the non-printable characters.
The space in the ASCII table has value 32 in the decimal numeral system, 20 in hex and 040 oct.
As rule only characters with the octal ASCII value within 040 and 176 are considered "printable" by isprint [isprint] (see the table). In decimal are the characters within [32-126] included.
Interesting to note that the space is a printable character for isprint
[isprint,isprint C++], even if it has no graphical representation[*] and it is often used as a field separator.
Hence, in the man we find a supplementary line just for the space [1] and in the COMMAND column:
Lsof only outputs printable (declared so by isprint(3)) 8 bit characters.
Non-printable characters are printed in one of three forms:
- the C '\[bfrnt]' form;
- the control character `^' form (e.g., ``^@'');
- or hexadecimal leading '\x' form (e.g., ``\xab'').
Space is non-printable in the COMMAND column (``\x20'') and printable elsewhere.
(indentation and bold are mine)
Interesting here is to know why it is considered "non-printable".
It seems for security reasons, as we can read from the FAQ[2]:
14.5.1 Why is space considered a non-printable character in command names?
Space is considered an unprintable character in command
names because it is sometimes possible to hide the full
command name from scripts that parse ps(1) output by
embedding a space in the name.
If you are annoyed by this output you may consider to read the
OUTPUT FOR OTHER PROGRAMS section of the lsof
man and the -F
option specifications:
When the -F option is specified, lsof produces output that is suitable for processing by another program - e.g, an awk or Perl script, or a C program.
...
[*] Note: It exists another function named isgraph
[isgraph C++] that checks whether c is a character with graphical representation but practically answers true for all those characters than can be printed (as by isprint) except the space character.
\x20
is an escaped space character (). – Daniel B – 2017-11-25T20:20:37.960
You can above get more info about process 7066 by using
ps aux | grep 7066
. Or even more info byps -eo pid,user,group,args,etime,lstart | grep 7066
. My guess would be the Web server (Apache). – harrymc – 2017-11-25T20:45:51.623Do you have in your computer connected/built-in any component made by X20, possibly a network controller? – harrymc – 2017-11-26T19:12:41.630
No, really. It’s a space. The actual executable or process name starts with "Web Co". You can easily replicate this by making a copy of
socat
, calling itWeb Content
and then making a network connection using that. – Daniel B – 2017-11-26T22:51:09.407