Hi,

I'm writing a module which intercepts various TCP functions. I'm trying to monitor the life cycle of sockets and connections in the system.
Anyway, every once in a while a socket is being destroyed, but the connection information the structure holds (namely i'm looking at the TCP source and destination ports) does not match the information seen by me in the last recv/send.
Also, sometimes connections are reset by the peer (TCP RST flag is set), and none of my socket close/destroy hooks get called.

I'm trying to find if sock structures may be reused without being "free"d, and if so, how I may detect such a scenario. I'm currently lost in the kernel code looking for such code.

Any help will be greatly appreciated,

Zvika