Finding the IP from the PID - shell

Question

I'm a newbie to shell programming and I'd like to find the IP address from the process ID. Right now, I'm able to get the PID for a specific process from :
vmname=$1
pid=`ps aux | grep $vmname | awk 'NR==1{printf("%s\n", $2) }'`
echo $pid
The above method returns the PID but how do I get the port from the pid? If I get the port, is there a command to get the IP address as well?
I'm using Ubuntu 11.04 and the above script is actually trying to find out the IP of a virtual machine running on KVM using this method.
Thanks!

Answer 1

You can employ the lsof utility. It gives the list of open files for a process. Use lsof -p pid . You need to grep on the output to get the port values for eg. something like this - lsof -p pid| grep TCP. This will list all the ports opened or connected to by the process. Refer to the manual of the utility. For most systems the utility comes pre-bundled with your OS. However, if it is not pre-bundled then you need to install this utility.

Answer 2

The PID and the computer's IP Address are two completely unrelated things.
PID stands for Process ID, and it's a handle for the OS to keep track of your program, among other things.
IP address is related to a network interface. Most computers have one or two of these (in the case of ethernet card/wireless device.)
Anyway, one way to get your computer's IP address is something similar to the following...There are quite possibly better ways to do it and I just don't know 'em...
$ ifconfig eth0
eth0 Link encap:Ethernet HWaddr 60:eb:69:96:da:87
inet addr:192.168.1.112 Bcast:192.168.1.255 Mask:255.255.255.0
inet6 addr: fe80::62eb:69ff:fe96:da87/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:876533 errors:0 dropped:0 overruns:0 frame:0
TX packets:560999 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:229205080 (229.2 MB) TX bytes:136756800 (136.7 MB)
Interrupt:40 Base address:0x8000
$ ifconfig eth0 | grep "inet addr"
inet addr:192.168.1.112 Bcast:192.168.1.255 Mask:255.255.255.0
$ ifconfig eth0 | grep "inet addr" | cut -d ":" -f 2
192.168.1.112 Bcast
$ ifconfig eth0 | grep "inet addr" | cut -d ":" -f 2 | cut -d " " -f 1
192.168.1.112
So the last command will get you what you want inside your script. The rest are just there to show you how I built up to the last command.

Answer 3

Before I start lsof should be used as suggested by #Drona if lsof and if root/su/sudo access is available.
For completness I was investigating this for getting the IP address of currently logged in chrooted SFTP users for a nagios script I did not want to have to create a sudoers rule for.
Easy way (not as easy as lsof and needs root but for completeness)
Step 1
$ ps -ef | grep ssh
UID PID PPID C STIME TTY TIME CMD
root 2479 14186 0 17:05 ? 00:00:00 sshd: sftpuser [priv]
1008 2481 2479 0 17:06 ? 00:00:00 sshd: sftpuser#notty
1008 2482 2481 0 17:06 ? 00:00:00 sshd: sftpuser#internal-sftp
root 2483 14186 0 17:06 ? 00:00:00 sshd: ttyuser [priv]
ttyuser 2485 2483 0 17:06 ? 00:00:00 sshd: ttyuser#pts/0
Above you can see the PID for the ssh users (added the ps columns for easier interpretation)
Step 2
sudo lsof -p 2481 | grep TCP
sshd 2481 root 3u IPv4 29176657 0t0 TCP 192.168.1.2:44156 (ESTABLISHED)
Alternative (more complex has the possibility of not needing rood)
Step 2 - Requires root access but is optional
$ sudo ls -l /proc/2481/fd
total 0
lrwx------ 1 root root 64 Jul 3 17:07 0 -> /dev/null
lrwx------ 1 root root 64 Jul 3 17:07 1 -> /dev/null
lr-x------ 1 root root 64 Jul 3 17:07 11 -> pipe:[29209918]
lrwx------ 1 root root 64 Jul 3 17:07 2 -> /dev/null
lrwx------ 1 root root 64 Jul 3 17:07 3 -> socket:[29209894]
lrwx------ 1 root root 64 Jul 3 17:07 5 -> socket:[29211080]
lr-x------ 1 root root 64 Jul 3 17:07 6 -> pipe:[29209915]
l-wx------ 1 root root 64 Jul 3 17:07 7 -> pipe:[29209915]
l-wx------ 1 root root 64 Jul 3 17:07 8 -> pipe:[29209916]
lr-x------ 1 root root 64 Jul 3 17:07 9 -> pipe:[29209917]
Step 3
$ fgrep 29209894 /proc/2481/net/tcp
8: 0101A8C0:0016 0201A8C0:B0B0 ...
here fgrep uses the number on the socked and the PID to extract the information.
The important information is 0101A8C0:0016 and 0201A8C0:B0B0. The first relates to ther server and the second is the connected client where the first part (split by the colon) is the hexadecimal representation of the reversed IP address and the second is the hexadecimal representation of the port. i.e
0101A8C0 -> 1.1.168.192 -> 192.168.1.1. If you know the port the server is listening on you can skip Step 2 and use the following instead of Step 3.
Step 2 + 3 Replacement when knowing the server port - if no root is availalble
in this case as I was checking for SFTP connections on the standard ssh port of 22 (in hex 0016)
$ fgrep 0016 /proc/2481/net/tcp
8: 0101A8C0:0016 0201A8C0:B0B0 ...