Hi,

I'm trying to troubleshoot a program that I don't have the source code
for.  I have performed a truss and it fails on the bind() statement due
to EADDRINUSE.  Here's an excerpt:

7702:   fstat64(7, 0xFFBEACB8)                          = 0
7702:   getsockopt(7, 65535, 8192, 0xFFBEADB8, 0xFFBEADB4, -121327688)
= 0
7702:   setsockopt(7, 65535, 8192, 0xFFBEADB8, 4, -121327688) = 0
7702:   fcntl(7, F_SETFL, 0x00000082)                   = 0
7702:   accept(7, 0xFFBEAE24, 0xFFBEAE34, 1)            = 9
7702:   shutdown(8, 2, 1)                               = 0
7702:   close(9)                                        = 0
7702:   close(7)                                        = 0
7702:   so_socket(2, 2, 0, "", 1)                       = 7
7702:   setsockopt(7, 65535, 4, 0xFFBEB48C, 4, 1)       = 0
7702:   bind(7, 0xFFBEB480, 16, 3)                      Err#125
EADDRINUSE

My question would be - how can I actually find out which port it is
trying to connect to, without access to source code?  I have tried
`truss -f -Tbind -rall -wall` and then used lsof to try to get the port
number from the stopped process but the port number does not get
listed.  I guess without actually connecting it probably won't be there
for lsof to see.

Thanks for any help.

[ Post a follow-up to this message ]

snoop75 wrote:
> Hi,
>
> I'm trying to troubleshoot a program that I don't have the source code
> for.  I have performed a truss and it fails on the bind() statement due
> to EADDRINUSE.  Here's an excerpt:
>
> 7702:   fstat64(7, 0xFFBEACB8)                          = 0
> 7702:   getsockopt(7, 65535, 8192, 0xFFBEADB8, 0xFFBEADB4, -121327688)
> = 0
> 7702:   setsockopt(7, 65535, 8192, 0xFFBEADB8, 4, -121327688) = 0
> 7702:   fcntl(7, F_SETFL, 0x00000082)                   = 0
> 7702:   accept(7, 0xFFBEAE24, 0xFFBEAE34, 1)            = 9
> 7702:   shutdown(8, 2, 1)                               = 0
> 7702:   close(9)                                        = 0
> 7702:   close(7)                                        = 0
> 7702:   so_socket(2, 2, 0, "", 1)                       = 7
> 7702:   setsockopt(7, 65535, 4, 0xFFBEB48C, 4, 1)       = 0
> 7702:   bind(7, 0xFFBEB480, 16, 3)                      Err#125
> EADDRINUSE
>
> My question would be - how can I actually find out which port it is
> trying to connect to, without access to source code?  I have tried
> `truss -f -Tbind -rall -wall` and then used lsof to try to get the port
> number from the stopped process but the port number does not get
> listed.  I guess without actually connecting it probably won't be there
> for lsof to see.

As a last resort if the application is not statically linked you could
do the following. Create your own .so which exports your own bind().
Output the port number from it. Use LD_PRELOAD variable to force the
application use bind() from your .so.

[ Post a follow-up to this message ]

In article <1150964207.159415.209470@r2g2000cwb.googlegroups.com>,
"snoop75" <snoopdogg75@hotmail.com> wrote:

> Hi,
>
> I'm trying to troubleshoot a program that I don't have the source code
> for.  I have performed a truss and it fails on the bind() statement due
> to EADDRINUSE.  Here's an excerpt:
>
> 7702:   fstat64(7, 0xFFBEACB8)                          = 0
> 7702:   getsockopt(7, 65535, 8192, 0xFFBEADB8, 0xFFBEADB4, -121327688)
> = 0
> 7702:   setsockopt(7, 65535, 8192, 0xFFBEADB8, 4, -121327688) = 0
> 7702:   fcntl(7, F_SETFL, 0x00000082)                   = 0
> 7702:   accept(7, 0xFFBEAE24, 0xFFBEAE34, 1)            = 9
> 7702:   shutdown(8, 2, 1)                               = 0
> 7702:   close(9)                                        = 0
> 7702:   close(7)                                        = 0
> 7702:   so_socket(2, 2, 0, "", 1)                       = 7
> 7702:   setsockopt(7, 65535, 4, 0xFFBEB48C, 4, 1)       = 0
> 7702:   bind(7, 0xFFBEB480, 16, 3)                      Err#125
> EADDRINUSE
>
> My question would be - how can I actually find out which port it is
> trying to connect to, without access to source code?  I have tried
> `truss -f -Tbind -rall -wall` and then used lsof to try to get the port
> number from the stopped process but the port number does not get
> listed.  I guess without actually connecting it probably won't be there
> for lsof to see.
>
> Thanks for any help.

Run it under a debugger, and set a breakpoint in bind(), and then look
at the sockaddr_in structure that the second argument is pointing to.

--
Barry Margolin, barmar@alum.mit.edu
Arlington, MA
*** PLEASE post questions in newsgroups, not directly to me ***
*** PLEASE don't copy me on replies, I'll read them in the group ***

[ Post a follow-up to this message ]