`netstat -ntp` odd 'Program name' presentation
Ralf Friedl
Ralf.Friedl at online.de
Sun Apr 22 15:32:00 UTC 2012
Cristian Ionescu-Idbohrn wrote:
> The 'Program name' part is fetched from /proc/<pid>/cmdline, then mangled
> before presentation. Mangling is done in netstat.c, function 'dir_act'.
> The function assumes cmdline is a file path and extracts the basename.
> Obviously that assumption is not always correct. It's not unusual a
> cmdline looks like this:
>
> sshd: foo at pts/48
>
> or like this:
>
> sshd: foo [priv]
>
> Function 'bb_basename' uses strrchr everything up to and including the
> last occurrence och character '/'. The result is (see first example
> above):
>
> PID/Program name
> 12345/48
>
> or (second example):
>
> PID/Program name
> 12345/sshd: foo [priv]
>
> Neither is desirable.
>
Why not (except for the case with only 48)?
If a program modified the result of cmdline it did so intentionally to
provide useful information.
So having
PID/Program name
12345/sshd: foo at pts/48
12346/sshd: foo [priv]
seems more useful than
PID/Program name
12345/sshd
12346/sshd
Actually a current version of netstat (net-tools-1.60) shows
PID/Program name
31103/sshd: root at no
which is the shortened form of "sshd: root at notty"
I agree that "sshd: foo at pts/48" should not be truncated to "48", which
net-tools-1.60 netstat unfortunately does.
Ralf
More information about the busybox
mailing list