userland process rpc.lockd opens untraceable ports...is something wrong here?

[Steve Kargl]

On Tue, Feb 19, 2019 at 04:38:50PM -0500, Mike Tancsa wrote:
> On 2/19/2019 4:24 PM, Freddie Cash wrote:
> > While it doesn't take you from a socket/port to a process, does
> > procstat at
> > least show you the sockets that rpc.lockd has open?
> >
> > Something like:  procstat -f <pid-of-rpc.lockd>
> >
> > Although, one could probably run the following to get from the socket/port
> > number to the process:  procstat -f -a | grep 600
> 
> It doesnt seem to.  sockstat shows
> 
> # sockstat | grep "^?"
> ?        ?          ?     ?  tcp4   *:845                 *:*
> ?        ?          ?     ?  udp4   *:833                 *:*
> ?        ?          ?     ?  udp4   *:2049                *:*
> ?        ?          ?     ?  udp6   *:976                 *:*
> ?        ?          ?     ?  tcp6   *:882                 *:*
> ?        ?          ?     ?  udp4   *:*                   *:*
> ?        ?          ?     ?  udp6   *:938                 *:*
> ?        ?          ?     ?  udp6   *:2049                *:*

The sockstat(8) manuals states 

  If a socket is not associated with any file descriptor,
  the first four columns have no meaning.

-- 
Steve