I am a question regarding sockets. We had a problem with socket leak the other day where the application failed to close the sockets properly and left thousands of them at CLOSE_WAIT state.

But when I looked into /proc/<pid>/fd, I found the file descriptors for these sockets... and my question is, how are these sockets timestamped? It seems that these file descriptors are timestamped at the instance when I look at them. For example, if I happen to be in /proc/<pid>/fd at 5:53pm and do an ls -l, these sockets will all show up as Feb 11 17:53... then if I do it again at 5:55pm, then the sockets created after the first "ls -l" will be timestamped at 17:55.

Why is that? Is it because these are symlinked?? What if I want to find their original time? Where should I look? Thanks.