Solved Mysterious entries in the output of sockstat -4

[obsigna]

My machine is running FreeBSD 10.1-RELEASE-p3 (GENERIC+IPsec)

Most of the output of sockstat -4 is well understood except the following at the very end:

USER     COMMAND    PID   FD PROTO  LOCAL ADDRESS         FOREIGN ADDRESS
...
?        ?          ?     ?  udp4   *:*                   *:*
?        ?          ?     ?  tcp4   *:935                 *:*
?        ?          ?     ?  udp4   *:925                 *:*
?        ?          ?     ?  udp4   *:2049                *:*

grep <portnum> /etc/services shows only something for port 2049:

nfsd        2049/sctp  nfs        # NFS server daemon
nfsd        2049/tcp   nfs        # NFS server daemon
nfsd        2049/udp   nfs        # NFS server daemon
#shilp        2049/tcp
#shilp        2049/udp

As a matter of fact, nfs is active on my machine -- ps -axj | grep nfsd:

root      804    1  804  804    0 Is    -    0:00.08 nfsd: master (nfsd)
root      805  804  804  804    0 I     -    0:00.01 nfsd: server (nfsd)

But why does sosckstat not name the service? Is this something to be concerned about? Anyway, those ports are not accessible from the WAN, i.e. not opened by ipfw.

 

[junovitch@]

I can't explain every connection there but for some cases sockstat -4 shows the question mark on connections that have been closed. You'll see them in the TIME_WAIT state in netstat -an. Obviously this doesn't cover every case but there should be nothing to be concerned about.

 

[worldi]

Educated guess: these sockets are handled by the kernel itself. So the userland features (i.e. user, command, PID and FD) are simply not available/applicable.

 

[obsigna]

Thank you junovitch, netstat -an shows the respective UDP ports in LISTEN state. I can even telnet to TCP935, although, I could not provoke any response by hacking-in a variety of sense and nonsense.

Thank you worldi, well this may explain the question marks, but does not make those open unregistered ports less mysterious.

It becomes even better, after each restart, the unregistered TCP and UDP ports -- in my original post 935 and 925 -- do vary, now they are on 1012 and 740 respectively.

Anyway, it turned out to be something related to NFS being active on my system. In /etc/rc.conf I have:

...
rpcbind_enable="YES"
rpc_lockd_enable="YES"
rpc_statd_enable="YES"
mountd_enable="YES"
mountd_flags="-r"
nfs_server_enable="YES"
...

Once I disable all NFS related stuff and after restart, the mysterious sockets disappear.