Tag Archives: netstat

There are numerous ways to accomplish getting the PID for an established network connection in AIX and Linux using tools like ss or more popular lsof.  In my situation, the system I was working on did not have ss or lsof, so I used netstat and rmsock.

If I know I have an established connection to a remote host, I can use netstat to narrow down and obtain the PCB/ADDR using the following command.

~ # netstat -naA|grep

f10000f3026fcb58 tcp4       0      0 ESTABLISHED

The first column of the netstat output is PCB/ADDR; using this value, I will use rmsock to identify the process.

~ # rmsock f10000f3026fcb58 tcpcb

The socket 0x26fc800 is being held by proccess 1302658 (x_ieswitch).

I can see the process ID (PID) is 1302658; to obtain more information, a simple ps command is executed.

~ # ps e 1302658


1302658  pts/0 A     0:00 x_ieswitch p1_webxt_out 1 p1_webxt_out WEBXTOUT 5 _=

There are many ways to achieve what was done here as I had mentioned – such as using lsof, ss or even taking a look at some of the resources here: IBM DeveloperWorks Wiki