From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751073AbWDTQj5 (ORCPT ); Thu, 20 Apr 2006 12:39:57 -0400 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S1751086AbWDTQj5 (ORCPT ); Thu, 20 Apr 2006 12:39:57 -0400 Received: from pproxy.gmail.com ([64.233.166.182]:61225 "EHLO pproxy.gmail.com") by vger.kernel.org with ESMTP id S1751073AbWDTQj4 convert rfc822-to-8bit (ORCPT ); Thu, 20 Apr 2006 12:39:56 -0400 DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=beta; d=gmail.com; h=received:message-id:date:from:to:subject:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references; b=PfXjiiR7dBGKFOZBkhBEmW9Rf62HX838M+5CmP04Zma5c6u1nCv1eLkDv+jHKYS8mObLnZp0cBR2GdR8BRbagkjB5jI2ESy/w+ppDgcPPD3QFwLyMpOnpQPftdTrTsY/Df1fwEh1WYO436yobyVTJ7ml1ZUMzmaWkPW1EkBGKvA= Message-ID: Date: Thu, 20 Apr 2006 09:39:55 -0700 From: "Joshua Hudson" To: linux-kernel@vger.kernel.org Subject: Re: Which process is associated with process ID 0 (swapper) In-Reply-To: <4447B110.4080700@gmail.com> MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7BIT Content-Disposition: inline References: <4447A19E.9000008@gmail.com> <4447B110.4080700@gmail.com> Sender: linux-kernel-owner@vger.kernel.org X-Mailing-List: linux-kernel@vger.kernel.org On 4/20/06, Mikado wrote: > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > linux-os (Dick Johnson) wrote: > > This must be a trick question. Linux is not VAX/VMS. There is no > > swapper process. Check in /proc. Processes start at 1. Even > > kernel threads have PIDs greater than 1. > > Linux really has swapper process ;) > > > Portions of the kernel networking code operate detached. The code > > gets the CPU from a timer queue or from an interrupt. When an > > connection is attempted, the process attempting the connection > > is either waiting, with its CPU time being used, or put to > > sleep, while the timer queue's CPU time is being used. The > > SYN/ACK handshake is handled during this time, therefore it > > is possible to find who is attempting that connection. Netstat > > gets that information from /proc/net and multiple socket > > calls. > > I'm writing kernel module that hooks into netfilter code. I can catch > packet's information and its owner process. The first SYN packet of > handshaking belongs to real user-space socket/process. After timeout, > several SYN packets are generated by kernel-space swapper process (PID > 0) Is there anyway to find out the relationship between them in > _kernel_space_ (module context). > I would recommend walking the list of sockets, and see what process(es) own the socket that is bound to that quad (host IP, port; foreigh IP, port). A better design might just be to hook connect(), but think hard on that one. If you do it, your module cannot be removed.