From 7099a7a52ec3d4bab96bcd3e3f70d72abdb54221 Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Tue, 21 Dec 2021 14:54:38 +1100 Subject: [PATCH] Fix. We should call the `net` type method here. --- volatility3/framework/plugins/linux/sockstat.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/linux/sockstat.py b/volatility3/framework/plugins/linux/sockstat.py index 323f02213..4f9ac64de 100644 --- a/volatility3/framework/plugins/linux/sockstat.py +++ b/volatility3/framework/plugins/linux/sockstat.py @@ -336,7 +336,7 @@ class Sockstat(plugins.PluginInterface): protocol = child_sock.protocol if hasattr(child_sock, "protocol") else "" net = task.nsproxy.net_ns - netns_id = net.proc_inum if net.has_member("proc_inum") else net.ns.inum + netns_id = net.get_inode() yield task, netns_id, fd_num, family, sock_type, protocol, sock_fields def _generator(self, pids, netns_arg, symbol_table):