Subject: Re: netstat and PIDs
To: VaX#n8 <>
From: Luke Mewburn <>
List: current-users
Date: 09/10/1996 17:16:19
VaX#n8 writes:
> I don't know if it would be possible, but it would be Really Nice if netstat
> had an option to show which PID had a particular connection open.  I could
> not find such an option, and a sysadmin friend agrees that this would be
> very helpful if you have a suspicious connection open and want to track
> it down.  I imagine the kernel must store this info somewhere since it has
> to deliver packets to said process - I guess via the descriptor table[s].

As others have mentioned, use fstat (as shipped), or lsof (3rd party

However, a long time ago I wrote patches to netstat (before I knew
about fstat) to do exactly this. And I submitted them as a PR.
Looking through the PR database on, I found the
(now closed) PR:
	bin/348: a hack to netstat(1) to show the owner of a connection

You can look at it at:

Hope that's helpful.

Luke Mewburn <>

"Think of it as Evolution in Action"      -- `Oath of Fealty', Niven & Pournelle