I have a Solaris 10 Server that has SSH enabled, I wanted to find out which specific process is responsible for opening the socket that listens for the port 22. I used the PFiles
utility to loop over all the processes in the /proc
folder to find this out using the simple script below:
PORT=22; for PID in /proc/*; do pfiles ${PID} |grep "port: ${PORT}" && echo ${PID}; done
What I found out was there are multiple processes listening to this same port. Sample output is below:
sockname: AF_INET6 ::ffff:10.192.18.188 port: 22 /proc/26766
sockname: AF_INET6 ::ffff:10.192.18.188 port: 22 /proc/26767
sockname: AF_INET6 :: port: 22 /proc/620
sockname: AF_INET6 ::ffff:10.192.18.188 port: 22 /proc/9131
sockname: AF_INET6 ::ffff:10.192.18.188 port: 22 /proc/9132
My question is, how is this possible? Can multiple processes listen for the same port on the same IP address? And if this is possible, do all this process IDs share a single socket that is bound to this address:port or have multiple sockets open each of which listens on the same address:port, and the kernel decides which socket to pass the connection to at a specific moment in time? Can someone kindly clarify? Thanks!
SO_REUSEPORT
was not supported in Solaris at the time they were written, but they are old. I'm not able to confirm the current status. Still this may advance your own research.PFiles
was possibly showing Listening Ports as well as Established Connection Ports of a Process. I'll have to re-run the utility in the Server and check. Thanks for your time!