How does LSOF map port to process on Solaris?

Question

I have an idea of how it's done on Linux, they probably go through /proc//fd and to display the sockets used by each process.

Unfortunately, it doesn't look like the /proc//fd entries list sockets on Solaris. Does anyone know how lsof would do it on this system? Or how one would even go about this in general?

Just to restate what exactly it is I need: I need some way to find which processes are listening to which ports (without using lsof of course) on Solaris.

Answer 1

If you're running Solaris 11.2, you can use netstat -u. Per the man page:

-u

Lists the user, process id, and the program which originally created the network endpoint or controls it now.

Answer 2

/proc/<pid>/fd lists all open file descriptors, including those associated with a socket, eg:

# pwd
/proc/408/fd
# ls -l
total 4
c---------   1 root     sys       13,  2 Jul 31 23:12 0
c---------   1 root     sys       97,  1 Jul 31 23:06 1
p---------   0 root     root           0 Jul 31 23:06 10
p---------   0 root     root           0 Jul 31 23:06 11
c---------   1 root     sys       97,  1 Jul 31 23:06 2
-r--r--r--   1 root     root        1209 Jul 31 23:06 3
D---------   1 root     root           0 Jul 31 23:06 4
s---------   0 root     root           0 Jul 31 23:06 5
s---------   0 root     root           0 Jul 31 23:06 6
p---------   0 root     root           0 Jul 31 23:06 7
p---------   0 root     root           0 Jul 31 23:06 8
s---------   0 root     root           0 Jul 31 23:06 9

Here file descriptors 5,6 and 9 are definitely sockets, as shows their s file type.

Not sure about what lsof is doing under the cover but to get socket details, pfiles is reading the process internal structures. See its dosocket methods.