Tag Archives: rmsock

There are numerous ways to accomplish getting the PID for an established network connection in AIX and Linux using tools like ss or more popular lsof.  In my situation, the system I was working on did not have ss or lsof, so I used netstat and rmsock.

If I know I have an established connection to a remote host 192.168.9.150, I can use netstat to narrow down and obtain the PCB/ADDR using the following command.

~ # netstat -naA|grep 192.168.9.150

f10000f3026fcb58 tcp4       0      0  10.147.204.10.40107 192.168.9.150.8010 ESTABLISHED

The first column of the netstat output is PCB/ADDR; using this value, I will use rmsock to identify the process.

~ # rmsock f10000f3026fcb58 tcpcb

The socket 0x26fc800 is being held by proccess 1302658 (x_ieswitch).

I can see the process ID (PID) is 1302658; to obtain more information, a simple ps command is executed.

~ # ps e 1302658

PID    TTY STAT  TIME COMMAND

1302658  pts/0 A     0:00 x_ieswitch p1_webxt_out 1 p1_webxt_out WEBXTOUT 5 _=

There are many ways to achieve what was done here as I had mentioned – such as using lsof, ss or even taking a look at some of the resources here: IBM DeveloperWorks Wiki