{"record":{"id":"ed5dec36f82ebcbd","repo":"XTLS/Xray-core","slug":"no-process-found-for-inode","errorCode":null,"errorMessage":"no process found for inode ","messagePattern":"no process found for inode ","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"common/net/find_process_linux.go","lineNumber":66,"sourceCode":"\ttargetHexAddr, err := formatLittleEndianString(net.ParseIP(srcIP), Port(srcPort))\n\tif err != nil {\n\t\treturn 0, \"\", \"\", errors.New(\"failed to format address: \", err)\n\t}\n\n\tinode, err := findInodeInFile(procFile, targetHexAddr)\n\tif err != nil {\n\t\treturn 0, \"\", \"\", errors.New(\"could not search in \", procFile).Base(err)\n\t}\n\tif inode == \"\" {\n\t\treturn 0, \"\", \"\", errors.New(\"connection for \", srcIP, \":\", srcPort, \" not found in \", procFile)\n\t}\n\n\tpidStr, err := findPidByInode(inode)\n\tif err != nil {\n\t\treturn 0, \"\", \"\", errors.New(\"could not find PID for inode \", inode, \": \", err)\n\t}\n\tif pidStr == \"\" {\n\t\treturn 0, \"\", \"\", errors.New(\"no process found for inode \", inode)\n\t}\n\n\tabsPath, err := getAbsPath(pidStr)\n\tif err != nil {\n\t\treturn 0, \"\", \"\", errors.New(\"could not get process name for PID \", pidStr, \":\", err)\n\t}\n\n\tnameSplit := strings.Split(absPath, \"/\")\n\tprocName := nameSplit[len(nameSplit)-1]\n\n\tpid, err := strconv.Atoi(pidStr)\n\tif err != nil {\n\t\treturn 0, \"\", \"\", errors.New(\"failed to parse PID: \", err)\n\t}\n\n\treturn pid, procName, absPath, nil\n}\n","sourceCodeStart":48,"sourceCodeEnd":84,"githubUrl":"https://github.com/XTLS/Xray-core/blob/7d214f8b094f75322fa3990f8aadad1c912f24f5/common/net/find_process_linux.go#L48-L84","documentation":"The socket inode was found in /proc/net/tcp{,6} but the scan of all processes' FD tables completed without any /proc/<pid>/fd/<n> linking to that inode. Either the owner is hidden from this user, or the socket is owned by the kernel (not any process), which happens for listener sockets in some states.","triggerScenarios":"hidepid mounted on /proc so other users' processes are invisible; the owning process exited after the socket table was read but before the FD scan; inode belongs to a kernel worker (e.g. some UDP tunnels, conntrack-owned sockets).","commonSituations":"Unprivileged process-based routing on multi-user systems; looking up sockets of setuid services; racing with process teardown.","solutions":["Run with privileges sufficient to see all processes' FD tables (root, or relax hidepid)","Retry once for races where the process list and socket table can be re-read consistently","Accept that kernel-owned sockets have no PID and route them by other criteria","Verify manually: ls -l /proc/*/fd 2>/dev/null | grep inode:<n>"],"exampleFix":null,"handlingStrategy":"fallback","validationCode":null,"typeGuard":"func isNoProcessForInode(err error) bool {\n    return err != nil && strings.Contains(err.Error(), \"no process found for inode\")\n}","tryCatchPattern":"if err != nil && isNoProcessForInode(err) {\n    // hidden owner or kernel-owned socket; route by other criteria\n}","preventionTips":["Relax hidepid or run elevated if cross-user sockets must be attributed","Remember kernel-owned sockets legitimately have no PID"],"tags":["linux","process-lookup","hidepid","permissions","kernel-sockets"],"backgroundTag":null,"analyzedSha":"7d214f8b094f75322fa3990f8aadad1c912f24f5","analyzedAt":"2026-08-15T14:26:24.325Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}