On a related note I was doing a final audit of one of my firewalls and I
was just trying to verify that the un-named UDP sockets reported by
'netstat' were indeed owned by the NFS mounts I still had running on the
machine.  Unfortunately 'fstat' doesn't mention these sockets (not even
if the mount is via TCP, though of course in that case it's a heck of a
lot easier to see what the socket's purpose is).

How hard would it be to have 'fstat' report all of the files and sockets
that the kernel has open?  Would anyone besides me find this helpful?

Would it also make sense to have the kernel register these ports with
the 'portmapper' (if it's running?).  For a long time now I've been
sitting on the beginnings of an attempt to get 'netstat' to do the
equivalent of an "rpcinfo -p" so that it could report the proper RCP
program name (i.e. instead of a TCP/UDP service name), possibly prefixed
with "RPC:" or whatever to indicate that the given port is indeed in use
for RPC.

-- 
							Greg A. Woods

+1 416 218-0098      VE3TCP      <gwoods@acm.org>      <robohack!woods>
Planix, Inc. <woods@planix.com>; Secrets of the Weird <woods@weird.com>