2

I'm working on a proxy for linux(C++) that, amongst other functions, keeps track of tcp connections and associates them with the process's pid. To do that, I get the inode in /proc/net/tcp and then parse all procs in /proc/pid/fd to see which process contains it. Pretty straightforward.

Problem is, that sometimes clients are able to open and close the connection faster that the proxy is able to parse the processes' fds. I noticed this field - "location of socket in memory", which is present in /proc/net/tcp https://www.kernel.org/doc/Documentation/networking/proc_net_tcp.txt

and I wonder if it might be of any help, the whole thing is very poorly documented, and I did not find any resouce online related to it.

My questions are: what exactly is meant by location of socket memory, how can it be accessed, and what can I find there?

Thank you.

1
  • Have you looked at the kernel connection tracker module ("conntrack"), in particular the "owner" options? And as for "location of socket", my guess would be that it points to the kernel structure in kernel and/or user space, which may or may not be useful. Anyhow, I don't think you can reliably track the TCP connections without help from the kernel.
    – dirkt
    Mar 25, 2019 at 12:01

0

You must log in to answer this question.

Browse other questions tagged .