On Sep  9,  9:11pm, VaX#n8 wrote:
} I don't know if it would be possible, but it would be Really Nice if netstat
} had an option to show which PID had a particular connection open.  I could
} not find such an option, and a sysadmin friend agrees that this would be
} very helpful if you have a suspicious connection open and want to track
} it down.  I imagine the kernel must store this info somewhere since it has
} to deliver packets to said process - I guess via the descriptor table[s].

  The -A option on netstat will display the address of the protocol block
associated with the connection, and that same address is displayed by the
output of the fstat program:

bash$ netstat -f inet -A
Active Internet connections
PCB      Proto Recv-Q Send-Q  Local Address      Foreign Address    (state)
  61a500 tcp        0      0  ppp.1021           net2.msu.mon.login ESTABLISHED
  626f00 tcp        0      0  ppp.1023           lightning.login    ESTABLISHED
  5ef400 tcp        0      0  ppp.1022           trex.login         ESTABLISHED
bash$ fstat |grep 61a500       
mhitch   rlogin       158    3* internet stream tcp 61a500
mhitch   rlogin       157    3* internet stream tcp 61a500

Michael

-- 
Michael L. Hitch			INTERNET:  osymh@montana.edu
Computer Consultant
Information Technology Center
Montana State University	Bozeman, MT	USA