netstat命令中UDP连接重复出现的疑问：最后4行是否为同一连接？

Hey there! Let's unpack what's going on with those repeated UDP lines you're seeing in netstat—and clear up a key misconception about UDP first.

First: UDP Doesn't Have "Connections" (Not Like TCP, Anyway) #

Unlike TCP, which establishes and maintains a full bidirectional connection tracked by the kernel, UDP is a connectionless protocol. What you see in netstat for UDP isn't a "connection"—it's either:

• A socket that's bound to a port and listening for incoming datagrams (marked as LISTEN in some systems), or
• A socket that the application has called connect() on (this tells the kernel to only accept datagrams from a specific target IP/port, but it's still not a true "connection" like TCP).

Why You're Seeing Duplicate Entries #

The most common reasons for repeated identical UDP lines in netstat are:

• Socket reuse with SO_REUSEPORT or SO_REUSEADDR: If multiple processes (or threads in the same process) bind to the same UDP port using these socket options, each bound socket will show up as a separate line in netstat. This is intentional—systems use this to distribute incoming datagrams across multiple sockets for better performance.
• Kernel display quirks: In some OSes, netstat might show duplicate lines for a single socket if it's in a transitional state (e.g., processing a datagram) or if the kernel holds multiple references to the same socket (like after a fork() call, where the child inherits the parent's sockets).
• Accidental output duplication: Rarely, netstat might repeat lines if there's a race condition between when it reads kernel data and when the data is updated, but this is less common.

Are These "The Same UDP Connection"? #

Since UDP doesn't have true connections, the question is a bit misframed—but here's the breakdown:

• If the duplicate lines have identical source IP/port, target IP/port, and state:
  • If they're LISTEN state: They're separate socket instances sharing the same listening port (thanks to reuse options).
  • If they're marked as "connected" (e.g., ESTABLISHED on some systems): They're either multiple sockets that the application has connected to the same target, or a single socket being displayed multiple times by netstat.

In short: They're not the same "connection" (since UDP doesn't do that), but they might be related to the same port or target endpoint.

内容的提问来源于stack exchange，提问作者OldSchool