Re: auditd reports port number '0' for connect() system call

I checked out with strings that I provided from the previous email. The first 3 ones gave me proper port numbers. $ ~/bin/sock_decode 020000358A0F6C0B0000000000000000 020000358A0F6C0B0000000000000000: sa_family: 2 addr: 191631242, port: 53 (13568) $ ~/bin/sock_decode 0200006F8A0FA5090000000000000000 0200006F8A0FA5090000000000000000: sa_family: 2 addr: 161812362, port: 111 (28416) $ ~/bin/sock_decode 0200030B8A0FA5090000000000000000 0200030B8A0FA5090000000000000000: sa_family: 2 addr: 161812362, port: 779 (2819) but, last three one didn’t $ ~/bin/sock_decode 0200000036447A640000000000000000 0200000036447A640000000000000000: sa_family: 2 addr: 1685734454, port: 0 (0) $ ~/bin/sock_decode 020000003644ECD00000000000000000 020000003644ECD00000000000000000: sa_family: 2 addr: 3505144886, port: 0 (0) $ ~/bin/sock_decode 02000000369520250000000000000000 02000000369520250000000000000000: sa_family: 2 addr: 622892342, port: 0 (0) Would you check this out? /Kangkook