I have an idea of how it's done on Linux, they probably go through /proc//fd and to display the sockets used by each process.
Unfortunately, it doesn't look like the /proc//fd entries list sockets on Solaris. Does anyone know how lsof would do it on this system? Or how one would even go about this in general?
Just to restate what exactly it is I need: I need some way to find which processes are listening to which ports (without using lsof of course) on Solaris.
/proc/<pid>/fd lists all open file descriptors, including those associated with a socket, eg:
# pwd
/proc/408/fd
# ls -l
total 4
c--------- 1 root sys 13, 2 Jul 31 23:12 0
c--------- 1 root sys 97, 1 Jul 31 23:06 1
p--------- 0 root root 0 Jul 31 23:06 10
p--------- 0 root root 0 Jul 31 23:06 11
c--------- 1 root sys 97, 1 Jul 31 23:06 2
-r--r--r-- 1 root root 1209 Jul 31 23:06 3
D--------- 1 root root 0 Jul 31 23:06 4
s--------- 0 root root 0 Jul 31 23:06 5
s--------- 0 root root 0 Jul 31 23:06 6
p--------- 0 root root 0 Jul 31 23:06 7
p--------- 0 root root 0 Jul 31 23:06 8
s--------- 0 root root 0 Jul 31 23:06 9
Here file descriptors 5,6 and 9 are definitely sockets, as shows their s file type.
Not sure about what lsof is doing under the cover but to get socket details, pfiles is reading the process internal structures. See its dosocket methods.
If you're running Solaris 11.2, you can use netstat -u. Per the man page:
-u
Lists the user, process id, and the program which originally created the network endpoint or controls it now.
