`netstat -ntp` odd 'Program name' presentation

Ralf Friedl Ralf.Friedl at online.de
Sun Apr 22 15:32:00 UTC 2012


Cristian Ionescu-Idbohrn wrote:
> The 'Program name' part is fetched from /proc/<pid>/cmdline, then mangled
> before presentation.  Mangling is done in netstat.c, function 'dir_act'.
> The function assumes cmdline is a file path and extracts the basename.
> Obviously that assumption is not always correct.  It's not unusual a
> cmdline looks like this:
>
> 	sshd: foo at pts/48
>
> or like this:
>
> 	sshd: foo [priv]
>
> Function 'bb_basename' uses strrchr everything up to and including the
> last occurrence och character '/'.  The result is (see first example
> above):
>
> 	PID/Program name
> 	12345/48
>
> or (second example):
>
> 	PID/Program name
> 	12345/sshd: foo [priv]
>
> Neither is desirable.
>   
Why not (except for the case with only 48)?
If a program modified the result of cmdline it did so intentionally to 
provide useful information.
So having
    PID/Program name
    12345/sshd: foo at pts/48
    12346/sshd: foo [priv]
seems more useful than
    PID/Program name
    12345/sshd
    12346/sshd

Actually a current version of netstat (net-tools-1.60) shows
    PID/Program name
    31103/sshd: root at no
which is the shortened form of "sshd: root at notty"

I agree that "sshd: foo at pts/48" should not be truncated to "48", which 
net-tools-1.60 netstat unfortunately does.

Ralf


More information about the busybox mailing list