NAME
net - network command
SYNOPSIS
net [-a] [[-s | -S] [-R ref] [pid | taskp]] [-n addr]
DESCRIPTION
Display various network related data:
-a display the ARP cache.
-s display open network socket/sock addresses, their family and type,
and their source and destination addresses and ports.
-S displays open network socket/sock addresses followed by a dump
of both structures.
-n addr translates an IP address expressed as a decimal or hexadecimal
value into a standard numbers-and-dots notation.
-R ref socket or sock address, or file descriptor.
pid a process PID.
taskp a hexadecimal task_struct pointer.
If no arguments are entered, the list of network devices, names and IP
addresses are displayed. The -R option, typically invoked from "foreach net",
and in conjunction with the -s or -S options, searches for references to a
socket address, sock address, or a file descriptor; if found, only the
referenced fd/socket/sock data will be displayed.
EXAMPLES
Display the network device list:
crash> net
DEVICE NAME IP ADDRESS(ES)
c0249f20 lo 127.0.0.1
c7fe6d80 eth0 10.1.8.20
Dump the ARP cache:
crash> net -a
IP ADDRESS HW TYPE HW ADDRESS DEVICE STATE
0.0.0.0 UNKNOWN 00 00 00 00 00 00 lo 40 (NOARP)
192.168.1.1 ETHER 00:50:54:fe:ef:23 eth0 04 (STALE)
192.168.1.10 ETHER 00:90:27:9c:6c:79 eth0 02 (REACHABLE)
192.168.1.118 ETHER 00:c0:4f:60:00:e2 eth0 02 (REACHABLE)
Display the sockets for PID 2517, using both -s and -S output formats:
crash> net -s 2517
PID: 2517 TASK: c1598000 CPU: 1 COMMAND: "rlogin"
FD SOCKET SOCK FAMILY:TYPE SOURCE:PORT DESTINATION:PORT
3 c57375dc c1ff1850 INET:STREAM 10.1.8.20:1023 10.1.16.62:513
crash> net -S 2517
PID: 2517 TASK: c1598000 CPU: 1 COMMAND: "rlogin"
FD SOCKET SOCK
3 c57375dc c1ff1850
struct socket {
state = SS_CONNECTED,
flags = 131072,
ops = 0xc023f820,
inode = 0xc5737540,
fasync_list = 0x0,
file = 0xc58892b0,
sk = 0xc1ff1850,
wait = 0xc14d9ed4,
type = 1,
passcred = 0 '\000',
tli = 0 '\000'
}
struct sock {
sklist_next = 0xc1ff12f0,
sklist_prev = 0xc216bc00,
bind_next = 0x0,
bind_pprev = 0xc0918448,
daddr = 1041236234,
rcv_saddr = 336068874,
dport = 258,
num = 1023,
bound_dev_if = 0,
next = 0x0,
pprev = 0xc0286dd4,
state = 1 '\001',
zapped = 0 '\000',
sport = 65283,
family = 2,
reuse = 0 '\000',
...
Translate the rcv_saddr from above into dotted-decimal notation:
crash> net -n 1041236234
10.1.16.62
From "foreach", find all tasks with references to socket c08ea3cc:
crash> foreach net -s -R c08ea3cc
PID: 2184 TASK: c7026000 CPU: 1 COMMAND: "klines.kss"
FD SOCKET SOCK FAMILY:TYPE SOURCE:PORT DESTINATION:PORT
5 c08ea3cc c50d3c80 INET:STREAM 0.0.0.0:1026 0.0.0.0:0
PID: 2200 TASK: c670a000 CPU: 1 COMMAND: "kpanel"
FD SOCKET SOCK FAMILY:TYPE SOURCE:PORT DESTINATION:PORT
5 c08ea3cc c50d3c80 INET:STREAM 0.0.0.0:1026 0.0.0.0:0
PID: 2201 TASK: c648a000 CPU: 1 COMMAND: "kbgndwm"
FD SOCKET SOCK FAMILY:TYPE SOURCE:PORT DESTINATION:PORT
5 c08ea3cc c50d3c80 INET:STREAM 0.0.0.0:1026 0.0.0.0:0
PID: 19294 TASK: c250a000 CPU: 0 COMMAND: "prefdm"
FD SOCKET SOCK FAMILY:TYPE SOURCE:PORT DESTINATION:PORT
5 c08ea3cc c50d3c80 INET:STREAM 0.0.0.0:1026 0.0.0.0:0
PID: 2194 TASK: c62dc000 CPU: 1 COMMAND: "kaudioserver"
FD SOCKET SOCK FAMILY:TYPE SOURCE:PORT DESTINATION:PORT
5 c08ea3cc c50d3c80 INET:STREAM 0.0.0.0:1026 0.0.0.0:0
PID: 2195 TASK: c6684000 CPU: 1 COMMAND: "maudio"
FD SOCKET SOCK FAMILY:TYPE SOURCE:PORT DESTINATION:PORT
5 c08ea3cc c50d3c80 INET:STREAM 0.0.0.0:1026 0.0.0.0:0
PID: 2196 TASK: c6b58000 CPU: 1 COMMAND: "kwmsound"
FD SOCKET SOCK FAMILY:TYPE SOURCE:PORT DESTINATION:PORT
5 c08ea3cc c50d3c80 INET:STREAM 0.0.0.0:1026 0.0.0.0:0
PID: 2197 TASK: c6696000 CPU: 0 COMMAND: "kfm"
FD SOCKET SOCK FAMILY:TYPE SOURCE:PORT DESTINATION:PORT
5 c08ea3cc c50d3c80 INET:STREAM 0.0.0.0:1026 0.0.0.0:0
PID: 2199 TASK: c65ec000 CPU: 0 COMMAND: "krootwm"
FD SOCKET SOCK FAMILY:TYPE SOURCE:PORT DESTINATION:PORT
5 c08ea3cc c50d3c80 INET:STREAM 0.0.0.0:1026 0.0.0.0:0
PID: 694 TASK: c1942000 CPU: 0 COMMAND: "prefdm"
FD SOCKET SOCK FAMILY:TYPE SOURCE:PORT DESTINATION:PORT
5 c08ea3cc c50d3c80 INET:STREAM 0.0.0.0:1026 0.0.0.0:0
PID: 698 TASK: c6a2c000 CPU: 1 COMMAND: "X"
FD SOCKET SOCK FAMILY:TYPE SOURCE:PORT DESTINATION:PORT
5 c08ea3cc c50d3c80 INET:STREAM 0.0.0.0:1026 0.0.0.0:0
PID: 2159 TASK: c4a5a000 CPU: 1 COMMAND: "kwm"
FD SOCKET SOCK FAMILY:TYPE SOURCE:PORT DESTINATION:PORT
5 c08ea3cc c50d3c80 INET:STREAM 0.0.0.0:1026 0.0.0.0:0
|