How do I determine who is using loopback interface?

From: Phil Farrell <farrell_at_pangea.Stanford.EDU>
Date: Wed, 03 Dec 1997 18:14:00 -0800 (PST)

Hi Managers,

I could use some help on this one. Running Digital UNIX 3.2d-1 on
AlphaServer 1000.

This afternoon, I noticed (using "monitor" utility) that my system
is sending huge numbers of network packets to itself on the software
network loopback interface (lo0) - from 500 to 1200 packets per second.
I have never seen more than a few packets per second before on
this interface. Of course, number of packets transmitted and received
on this interface are identical. The normal ethernet interface
(tu0) is showing about 100 to 300 packets per second input and output.

Can anyone give me some ideas to find out which process is creating
all these packets on the loopback interface? This is a server
system - it does not have a graphics console running X, so
they shouldn't be packets to the "unix:0" X display. But I
suppose a misbehaving program could be trying that.

I tried to see what I could find out with "netstat". The "-a"
option shows all open connections. I did not see any from
the machine to itself. I looked at a complete process list
from "ps" but did not see any funny looking process names
(there are about 500 processes running on this system from > 100 users).

This high usage of the loopback interface has been going on for
over one hour of which I am aware.

Thanks for any ideas.

-Phil Farrell, Computer Systems Manager
Stanford University School of Earth Sciences
farrell_at_pangea.stanford.edu
Received on Thu Dec 04 1997 - 03:14:21 NZDT

This archive was generated by hypermail 2.4.0 : Wed Nov 08 2023 - 11:53:37 NZDT