XTLS/Xray-core · error

could not search in

Error message

could not search in 

What it means

Linux FindProcess could not read the kernel socket table (/proc/net/tcp, tcp6, udp or udp6) while searching for the connection's inode. The error is chained (Base) to the os.Open / scanner failure, so the underlying reason (usually EACCES or ENOENT) is in err's chain.

Source

Thrown at common/net/find_process_linux.go:55

		}
	case "udp":
		if net.ParseIP(srcIP).To4() != nil {
			procFile = "/proc/net/udp"
		} else {
			procFile = "/proc/net/udp6"
		}
	default:
		panic("Unsupported network type for process lookup.")
	}

	targetHexAddr, err := formatLittleEndianString(net.ParseIP(srcIP), Port(srcPort))
	if err != nil {
		return 0, "", "", errors.New("failed to format address: ", err)
	}

	inode, err := findInodeInFile(procFile, targetHexAddr)
	if err != nil {
		return 0, "", "", errors.New("could not search in ", procFile).Base(err)
	}
	if inode == "" {
		return 0, "", "", errors.New("connection for ", srcIP, ":", srcPort, " not found in ", procFile)
	}

	pidStr, err := findPidByInode(inode)
	if err != nil {
		return 0, "", "", errors.New("could not find PID for inode ", inode, ": ", err)
	}
	if pidStr == "" {
		return 0, "", "", errors.New("no process found for inode ", inode)
	}

	absPath, err := getAbsPath(pidStr)
	if err != nil {
		return 0, "", "", errors.New("could not get process name for PID ", pidStr, ":", err)
	}

View on GitHub (pinned to 7d214f8b09)

Solutions

1. Inspect the chained error for EACCES vs ENOENT to distinguish policy from missing /proc
2. Remount /proc properly in the container: docker run --rm with default /proc, avoid --proc-mounted subset=pid for this workload
3. If the environment intentionally hides /proc, disable process-based routing rules there
4. Run as a user allowed to read /proc/net/tcp (world-readable by default; a denial indicates an LSM/hidepid policy)

for _, f := range []string{"/proc/net/tcp", "/proc/net/udp", "/proc/net/tcp6", "/proc/net/udp6"} {
    if _, err := os.Stat(f); err != nil {
        // /proc unavailable; process lookup cannot work in this environment
    }
}

if err != nil && strings.Contains(err.Error(), "could not search in /proc/net") {
    // inspect chained error: EACCES => policy, ENOENT => /proc missing; both environment-level
    newError("/proc unreadable; disabling process rules").Base(err).WriteToLog()
}

When it happens

Trigger: /proc is not mounted (rare, broken container), /proc/net/tcp is unreadable due to hidepid or LSM policy, or the file read fails mid-scan. The path in the message tells which table was being read.

Common situations: Hardened containers where /proc is masked or mounted with subset=pid; grsecurity kernels restricting /proc/net; chroots without /proc.

Related errors

• could not find PID for inode :
• could not get process name for PID :
• failed to determine if address is local:
• no process found for inode
• failed to list processes

AI-assisted analysis of XTLS/Xray-core@7d214f8b09 (2026-08-15). Data as JSON: /api/errors/7a8a99313d898cef. Report an issue: GitHub.