how to deduce connect/accept history from struct sock? (REPEAT)

From: Joey Dewille
Date: Thu May 13 2004 - 17:44:39 EST

Say a module is inserted that intercepts all socket operations and
it happened in the middle of several established connections.
Please answer what fields in struct sock or elsewhere can be examined
to determine reliably if the current established connections had been
accepted (i.e. accept call) or initiated (i.e. connect) from the local

P.S. By the way, it seems to me that many fundamental structs in the
linux kernel such as sock, task_struct and others waste memory --
it would be preferable to pack some of their members in
bitfields. Everything and the kitchen sink can be found in those
structs which is wrong. Booleans are often given an entire char field.
Other members do not fall on natural alignment boundaries and create
holes. Memory is cheap but smaller memory footprint implies better
locality of reference, implies greater cache induced performance overall.

-- - Consolidate POP email and Hotmail in one place
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at
Please read the FAQ at