many SNPP in netstat

[Tigran]

netstat -a lists many (thousands) of CLOSE_WAIT state connections from
localhost to localhost:snpp. Anybody know how I can trace to find the
source of these connections?

I'm googling about snpp and it sounds like a paging protocal but I
don't use this system for any paging. This is on a Novell Linux.

thanks
--Tigran

[Arshavir]

You can see the process which created the connection by specifying the -p flag to netstat.

Sent from my iPhone

> --
> You received this message because you are subscribed to the UCLA LUG "Linux" group.
> To post to this group, send email to li...@linux.ucla.edu
> To unsubscribe from this group, send email to
> linux+un...@linux.ucla.edu
> For more options, visit this group at
> http://groups.google.com/a/linux.ucla.edu/group/linux?hl=en

[Chris Stromsoe]

Figure out what's listening on the snpp port and shut it off.

sudo lsof -i tcp:snpp

-Chris

[Tigran K]

I figured out the process name ics_dyn which is part of Novell Access
Gateway but I don't know how to figure out why there were so many. I
had netstat -a running for 5 minutes and it wouldn't stop listing and
all of them were snpp.

I'm not sure if it's related or not but at the same time bunch of
items from /dev were missing. I have a similar system and one of them
had few hundred items and the system with the problem had only 10 or
so.

Two of the items missing /dev/random and /dev/urandom also broke my sshd.

After I rebooted the server the items in /dev went back to normal.

Do you know what would cause that?

Thanks

[Chris Stromsoe]

If you're using udev and /dev is a shm mount, unmounting the shm /dev will
leave you with whatever is in /dev on the root device. Or just deleting
all the devices.

-Chris