4

The last 2 lines of lsof -i are shown as below. What are those? I use OpenSuse LEAP 42.2.

Web\x20Co 7066 user1   38u  IPv4  76006      0t0  UDP *:43756 
Web\x20Co 7066 user1   39u  IPv6  76008      0t0  UDP *:46834
lonelyloner
  • 201
  • 3
  • 6
  • `\x20` is an escaped space character (` `). – Daniel B Nov 25 '17 at 20:20
  • You can above get more info about process 7066 by using `ps aux | grep 7066`. Or even more info by `ps -eo pid,user,group,args,etime,lstart | grep 7066`. My guess would be the Web server (Apache). – harrymc Nov 25 '17 at 20:45
  • Do you have in your computer connected/built-in any component made by X20, possibly a network controller? – harrymc Nov 26 '17 at 19:12
  • No, really. It’s a space. The actual executable or process name starts with "Web Co". You can easily replicate this by making a copy of `socat`, calling it `Web Content` and then making a network connection using that. – Daniel B Nov 26 '17 at 22:51

2 Answers2

2

The \x20 string in the first column is a hexadecimal value for an ASCII character, in this case the space character. The output formatting used by lsof is described on the lsof man page.

Lsof only outputs printable (declared so by isprint(3)) 8 bit characters.  Non-printable characters are printed in one of three forms: the  C  ``\[bfrnt]''  form;  the
   control  character `^' form (e.g., ``^@''); or hexadecimal leading ``\x'' form (e.g., ``\xab'').  Space is non-printable in the COMMAND column (``\x20'') and printable
   elsewhere.

The man page describes that for the COMMAND column (shown on the left in the example output) the space character is treated as non-printable.

Chris Hill
  • 191
  • 1
  • 3
1

The \x20 is a space.

The \x20 is a space "".
The hexadecimal prefix \x is one of the 3 ways forlsof to print the non-printable characters.
The space in the ASCII table has value 32 in the decimal numeral system, 20 in hex and 040 oct.

As rule only characters with the octal ASCII value within 040 and 176 are considered "printable" by isprint [isprint] (see the table). In decimal are the characters within [32-126] included.

Interesting to note that the space is a printable character for isprint[isprint,isprint C++], even if it has no graphical representation[*] and it is often used as a field separator.

Hence, in the man we find a supplementary line just for the space [1] and in the COMMAND column:

Lsof only outputs printable (declared so by isprint(3)) 8 bit characters.
Non-printable characters are printed in one of three forms:

  • the C '\[bfrnt]' form;
  • the control character `^' form (e.g., ``^@'');
  • or hexadecimal leading '\x' form (e.g., ``\xab'').

Space is non-printable in the COMMAND column (``\x20'') and printable elsewhere.

(indentation and bold are mine)

Why the space is a non-printable character?

Interesting here is to know why it is considered "non-printable".
It seems for security reasons, as we can read from the FAQ[2]:

14.5.1 Why is space considered a non-printable character in command names?

Space is considered an unprintable character in command
names because it is sometimes possible to hide the full
command name from scripts that parse ps(1) output by
embedding a space in the name.

Some words more

If you are annoyed by this output you may consider to read the OUTPUT FOR OTHER PROGRAMS section of the lsof man and the -F option specifications:

When the -F option is specified, lsof produces output that is suitable for processing by another program - e.g, an awk or Perl script, or a C program.
...

[*] Note: It exists another function named isgraph[isgraph C++] that checks whether c is a character with graphical representation but practically answers true for all those characters than can be printed (as by isprint) except the space character.

Hastur
  • 18,764
  • 9
  • 52
  • 95