What is Web\x20Co in lsof -i

4

1

The last 2 lines of lsof -i are shown as below. What are those? I use OpenSuse LEAP 42.2.

Web\x20Co 7066 user1   38u  IPv4  76006      0t0  UDP *:43756 
Web\x20Co 7066 user1   39u  IPv6  76008      0t0  UDP *:46834

lonelyloner

Posted 2017-03-29T19:46:58.087

Reputation: 181

\x20 is an escaped space character (). – Daniel B – 2017-11-25T20:20:37.960

You can above get more info about process 7066 by using ps aux | grep 7066. Or even more info by ps -eo pid,user,group,args,etime,lstart | grep 7066. My guess would be the Web server (Apache). – harrymc – 2017-11-25T20:45:51.623

Do you have in your computer connected/built-in any component made by X20, possibly a network controller? – harrymc – 2017-11-26T19:12:41.630

No, really. It’s a space. The actual executable or process name starts with "Web Co". You can easily replicate this by making a copy of socat, calling it Web Content and then making a network connection using that. – Daniel B – 2017-11-26T22:51:09.407

Answers

2

The \x20 string in the first column is a hexadecimal value for an ASCII character, in this case the space character. The output formatting used by lsof is described on the lsof man page.

Lsof only outputs printable (declared so by isprint(3)) 8 bit characters.  Non-printable characters are printed in one of three forms: the  C  ``\[bfrnt]''  form;  the
   control  character `^' form (e.g., ``^@''); or hexadecimal leading ``\x'' form (e.g., ``\xab'').  Space is non-printable in the COMMAND column (``\x20'') and printable
   elsewhere.

The man page describes that for the COMMAND column (shown on the left in the example output) the space character is treated as non-printable.

Chris Hill

Posted 2017-03-29T19:46:58.087

Reputation: 191

1

The \x20 is a space.

The \x20 is a space "".
The hexadecimal prefix \x is one of the 3 ways forlsof to print the non-printable characters.
The space in the ASCII table has value 32 in the decimal numeral system, 20 in hex and 040 oct.

As rule only characters with the octal ASCII value within 040 and 176 are considered "printable" by isprint [isprint] (see the table). In decimal are the characters within [32-126] included.

Interesting to note that the space is a printable character for isprint[isprint,isprint C++], even if it has no graphical representation[*] and it is often used as a field separator.

Hence, in the man we find a supplementary line just for the space [1] and in the COMMAND column:

Lsof only outputs printable (declared so by isprint(3)) 8 bit characters.
Non-printable characters are printed in one of three forms:

  • the C '\[bfrnt]' form;
  • the control character `^' form (e.g., ``^@'');
  • or hexadecimal leading '\x' form (e.g., ``\xab'').

Space is non-printable in the COMMAND column (``\x20'') and printable elsewhere.

(indentation and bold are mine)

Why the space is a non-printable character?

Interesting here is to know why it is considered "non-printable".
It seems for security reasons, as we can read from the FAQ[2]:

14.5.1 Why is space considered a non-printable character in command names?

Space is considered an unprintable character in command
names because it is sometimes possible to hide the full
command name from scripts that parse ps(1) output by
embedding a space in the name.

Some words more

If you are annoyed by this output you may consider to read the OUTPUT FOR OTHER PROGRAMS section of the lsof man and the -F option specifications:

When the -F option is specified, lsof produces output that is suitable for processing by another program - e.g, an awk or Perl script, or a C program.
...


[*] Note: It exists another function named isgraph[isgraph C++] that checks whether c is a character with graphical representation but practically answers true for all those characters than can be printed (as by isprint) except the space character.

Hastur

Posted 2017-03-29T19:46:58.087

Reputation: 15 043