Parse a /proc/net/tcp line and detect a public LISTEN

Challenge

Parse one line of Linux's /proc/net/tcp and decide whether it is a socket listening on a public interface — the core check behind tools like ss and netstat.

Each line looks like this (only the first columns matter here):

  sl  local_address rem_address   st ...
   0: 00000000:0050 00000000:0000 0A ...

local_address is IIIIIIII:PPPP — I is the IPv4 address in the kernel's hex form and P is the port. The third column (st) is the socket state, where 0A means LISTEN.

Task

Implement int is_public_listen(const char *line) that returns 1 when the line is both:

• in state 0A (LISTEN), and
• bound to 0.0.0.0, i.e. its local_address begins with 00000000:.

Otherwise return 0. Ignore the leading sl index and any whitespace.

Input

• line: one fixed line of /proc/net/tcp text the grader provides (a NUL-terminated string; may be empty).

Output

Returns 1 for a public LISTEN socket, 0 otherwise.

Example

"  0: 00000000:0050 00000000:0000 0A ..."   ->   1   (LISTEN on 0.0.0.0:80)
"  1: 0100007F:1F90 00000000:0000 0A ..."   ->   0   (loopback 127.0.0.1 only)
"  2: 00000000:0050 0A0A0A0A:F123 01 ..."   ->   0   (ESTABLISHED, not LISTEN)
""                                          ->   0

Edge cases

• Extra leading whitespace: still parsed.
• An IPv6 line (different format): return 0.
• Empty line: return 0.

Why this matters

The single most useful Linux defender query is 'what's listening?'. /proc/net/tcp answers it; parsing it lets you write the same tool that powers ss/netstat.

Input format

One fixed line of /proc/net/tcp text (NUL-terminated; may be empty).

Output format

1 if the line is a LISTEN (state 0A) bound to 0.0.0.0; otherwise 0.

Constraints

Pure string scan; ignore the leading sl index and whitespace.

Starter code

int is_public_listen(const char *line) { /* TODO */ (void)line; return 0; }

Common mistakes

Comparing the state column without skipping the address columns.

Edge cases to handle

Line with extra whitespace; line for IPv6 (different format — return 0).

Complexity

O(strlen).

Background lessons

• /proc forensics — a cookbook
• Log parsing — line iteration + classification

Up next

• Decide whether an fd-target string is suspicious
• Parse a /proc/self/maps line