# strange connections with no PID under root [solved]

## romalong

hi!

i got strange connections with no PID under root:

```

localhost lng # netstat -tep

Active Internet connections (w/o servers)

Proto Recv-Q Send-Q Local Address           Foreign Address         State       User       Inode      PID/Program name

tcp        0      0 192.168.1.2:42892       www.abbyy.com:http      ESTABLISHED lng        41625      5486/firefox-bin

tcp        0      0 192.168.1.2:42893       www.abbyy.com:http      ESTABLISHED lng        41626      5486/firefox-bin

tcp        0      0 192.168.1.2:42888       www.abbyy.com:http      ESTABLISHED lng        41614      5486/firefox-bin

tcp        0      0 192.168.1.2:42889       www.abbyy.com:http      ESTABLISHED lng        41615      5486/firefox-bin

tcp        0      0 192.168.1.2:42890       www.abbyy.com:http      ESTABLISHED lng        41621      5486/firefox-bin

tcp        0      0 192.168.1.2:42891       www.abbyy.com:http      ESTABLISHED lng        41624      5486/firefox-bin

localhost lng # kill 5486

localhost lng # netstat -tep

Active Internet connections (w/o servers)

Proto Recv-Q Send-Q Local Address           Foreign Address         State       User       Inode      PID/Program name

tcp        0      0 192.168.1.2:42892       www.abbyy.com:http      TIME_WAIT   root       0          -

tcp        0      0 192.168.1.2:42893       www.abbyy.com:http      TIME_WAIT   root       0          -

tcp        0      0 192.168.1.2:42888       www.abbyy.com:http      TIME_WAIT   root       0          -

tcp        0      0 192.168.1.2:42889       www.abbyy.com:http      TIME_WAIT   root       0          -

tcp        0      0 192.168.1.2:42890       www.abbyy.com:http      TIME_WAIT   root       0          -

tcp        0      0 192.168.1.2:42891       www.abbyy.com:http      TIME_WAIT   root       0          - 

```

Last edited by romalong on Thu Feb 26, 2009 6:13 am; edited 1 time in total

----------

## jongeek

Socket connections can go into a TIME_WAIT state, which means the connections are closed, but the sockets were not properly shutdown and so the resources have not been freed by the system. They should time out and go away on their own after a couple of minutes. I'm not sure what the exact timeout is.

Did they go away on their own ?

Do they show up when you close firefox cleanly ?

----------

## romalong

ok, if i close Firefox, similar root processes appear:

```

localhost lng # netstat -tep

Active Internet connections (w/o servers)

Proto Recv-Q Send-Q Local Address           Foreign Address         State       User       Inode      PID/Program name

tcp        0      0 192.168.1.2:33594       top100-images.ramb:http TIME_WAIT   root       0          -

tcp        0      0 192.168.1.2:46735       grisham.streamserv:ircd ESTABLISHED lng        46062      9394/irssi

tcp        0      0 192.168.1.2:43085       mail.gentoo.ru:http     ESTABLISHED lng        47008      9212/firefox-bin

tcp        0      0 192.168.1.2:43087       mail.gentoo.ru:http     ESTABLISHED lng        47114      9212/firefox-bin

tcp        0      0 192.168.1.2:43086       mail.gentoo.ru:http     ESTABLISHED lng        47113      9212/firefox-bin

tcp        0      0 192.168.1.2:56872       64.12.24.249:aol        ESTABLISHED lng        45845      9383/sim

tcp        0      0 192.168.1.2:49055       mu-in-f127.google.:http ESTABLISHED lng        47197      9212/firefox-bin

localhost lng # netstat -tep

Active Internet connections (w/o servers)

Proto Recv-Q Send-Q Local Address           Foreign Address         State       User       Inode      PID/Program name

tcp        0      0 192.168.1.2:33594       top100-images.ramb:http TIME_WAIT   root       0          -

tcp        0      0 192.168.1.2:46735       grisham.streamserv:ircd ESTABLISHED lng        46062      9394/irssi

tcp        0      0 192.168.1.2:43085       mail.gentoo.ru:http     TIME_WAIT   root       0          -

tcp        0      0 192.168.1.2:43087       mail.gentoo.ru:http     TIME_WAIT   root       0          -

tcp        0      0 192.168.1.2:43086       mail.gentoo.ru:http     TIME_WAIT   root       0          -

tcp        0      0 192.168.1.2:56872       64.12.24.249:aol        ESTABLISHED lng        45845      9383/sim

tcp        0      0 192.168.1.2:49055       mu-in-f127.google.:http TIME_WAIT   root       0          -

```

----------

## jongeek

But do they go away on their own after a few minutes ? Or do they hang around forever ?

----------

## romalong

yes, they disappear in a some time.

----------

## jongeek

This is normal behavior for Linux. Here are more technical details on how it works, if you're interested.

http://www.faqs.org/faqs/unix-faq/socket/

See section 2.7.    Please explain the TIME_WAIT state.

----------

## romalong

thanx for the info!

----------

## romalong

 *jongeek wrote:*   

> This is normal behavior for Linux. Here are more technical details on how it works, if you're interested.
> 
> http://www.faqs.org/faqs/unix-faq/socket/
> 
> See section 2.7.    Please explain the TIME_WAIT state.

 

now i understand what TIME_WAIT is for. but why is there root user?

----------

## jongeek

Since the connection has been closed, and the process is no longer in existence, the information about which user opened the socket has been lost. So the kernel does not know who it _was_ owned by, and just uses the root uid.

----------

## romalong

thank you very much!

----------

