Skip to content

[linux] Display connection state for UDP sockets#358

Open
kurok wants to merge 2 commits intolsof-org:masterfrom
kurok:feat/udp-connection-state
Open

[linux] Display connection state for UDP sockets#358
kurok wants to merge 2 commits intolsof-org:masterfrom
kurok:feat/udp-connection-state

Conversation

@kurok
Copy link
Contributor

@kurok kurok commented Mar 13, 2026

Summary

Display connection state for UDP sockets in lsof output, addressing the feature request in #287.

  • Connected UDP sockets (those that called connect()) now show (ESTABLISHED), matching the behavior of netstat and ss
  • Unconnected UDP sockets remain displayed without a state to avoid noise
  • Works across all output modes: text, field (-F), and JSON (-j)

Before:

NetworkMa  734 user  25u  IPv4 20544929  0t0  UDP 10.0.2.15:68->10.0.2.2:67

After:

NetworkMa  734 user  25u  IPv4 20544929  0t0  UDP 10.0.2.15:68->10.0.2.2:67 (ESTABLISHED)

Implementation

Linux /proc/net/udp already exposes socket state using the same tcp_state enum values. lsof was already reading and storing these values — it just never displayed them. The UdpSt[] state table infrastructure already existed in lib/misc.c and was used by other dialects (e.g. Solaris).

Changes:

  • lib/dialects/linux/dsock.c — Register ESTABLISHED UDP state in build_IPstates()
  • src/dialects/linux/dprint.c — Handle lts.type == 1 (UDP) in print_tcptpi() using UdpSt[] table
  • src/print.c — Handle UDP states in JSON output path

Test plan

  • Added case-20-udp-socket-state.bash test that creates a connected UDP socket and verifies (ESTABLISHED) appears in lsof output
  • Verified unconnected UDP sockets show no state (clean output)
  • Verified JSON output includes "state":"ESTABLISHED" for connected UDP
  • Full test suite passes (tested in Docker on Ubuntu 24.04)

Closes #287

kurok added 2 commits March 13, 2026 15:07
Register UDP socket states in build_IPstates() so that connected UDP
sockets (those that called connect()) display (ESTABLISHED), matching
the behavior of netstat and ss.

Linux /proc/net/udp reuses TCP state enum values: TCP_ESTABLISHED for
connected sockets and TCP_CLOSE for unconnected ones. Only ESTABLISHED
is registered; unconnected sockets remain displayed without a state
to avoid noise.

Update text, field (-F), and JSON (-j) output paths to handle UDP
states via the existing UdpSt[] infrastructure.

Add test case-20-udp-socket-state.bash to verify connected UDP sockets
show (ESTABLISHED) in lsof output.

Closes lsof-org#287
Use sleep as stdin instead of /dev/zero for nc UDP connections.
ncat sends /dev/zero as a single datagram causing "Message too long"
on UDP sockets. sleep keeps the process alive without flooding data.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[FEATURE] UDP connection status display

1 participant