UNKNOWN sockets in 2.1.42

Evan Jeffrey (ejeffrey@eliot213.wuh.wustl.edu)
Mon, 09 Jun 1997 17:52:44 -0500

What causes sockets to go into the "unknown" (as reported by netstat) state?
I have seen them before, but today I got 11 of them. 8 were from the same
host, connecting to my "auth" port, as such:

tcp 1 1 eliot213.wuh.wust:auth jalapeno.ucs.ind:38188 UNKNOWN root

The other 3 were all from a second host, all three ftp (transfer, not
master) sockets, like so:

tcp 1 1 eliot213.wuh.wustl.:20 spr186.pp.dlc.fi:1072 UNKNOWN root

In general, I have seen them appear more often from particular hosts, but
never in such great numbers at once. Typically, this happens on either
smpt, auth, or port 20, but then again, those are the ports most commonly

Evan Jeffrey

Let us go. Let us leave this festering hell hole. Let us think the
unthinkable, let us do the undoable. Let us prepare to grapple with the
ineffable itself, and see if we may not eff it after all.
--Dirk Gently