Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I use ss -p to see TCP sockets information. But process info are not printed for some sockets. Below:

$ ss -p4
State  Recv-Q  Send-Q  Local Address:Port   Peer Address:Port
ESTAB  0       0       10.146.18.213:50368  199.7.59.72:http

But with sudo, I can see the process info:

$ sudo ss -p4
State  Recv-Q  Send-Q  Local Address:Port   Peer Address:Port
ESTAB  0       0       10.146.18.213:50368  199.7.59.72:http      users:(("sshd",473,18))

With netstat -net, no root, I can see the user:

$ netstat -net
Active Internet connections (w/o servers)
Proto Recv-Q Send-Q Local Address               Foreign Address             State       User       Inode
tcp        0      0 10.146.18.213:50368         199.7.59.72:80              ESTABLISHED 222        3693189

My user id is 222:

$ id -u
222

But ss shows process info only with root.

My questions are:

  1. Why are there sockets with no user associated?
  2. Are these sockets with no user subjected to the owner module matching of iptables?
share|improve this question
    
Add the output of 'ss -p' to your question. Have you tried 'netstat -net' as root? –  Eli Rosencruft Apr 10 '12 at 14:56
    
I have added them. Does ss do it right way? –  fossilet Apr 11 '12 at 2:02
    
Why do you think iptables is relevant here? –  Mikel Apr 11 '12 at 3:37
    
I am trying match the SSH tunnel traffic using iptables owner module. Have not get it work and wondering about the reason. –  fossilet Apr 11 '12 at 12:12
add comment

1 Answer

I'd say your "sudo ss" shows connection related to user sshd, meanwhile "netstat -net" — to your own user. That's why netstat's version doesn't require sudo to find out the details regarding the socket.

You can use ss -e to get UID as well.

share|improve this answer
    
sshd is the process command name, not the user name. And 473 is the process id. –  fossilet Apr 11 '12 at 12:10
    
You said "But with sudo, I can see the user", that's why I thought it was username. –  poige Apr 11 '12 at 13:49
    
@fossilet, + actually, you can use ss -e to get UID as well. –  poige Apr 11 '12 at 13:56
    
@fossilet in other words, you were misled too since ss w/o -e shows not user name, but process name, which is hidden unless you're root or it's your own socket. –  poige Apr 11 '12 at 14:00
    
@fossilet, also my investigation shows that root is the only user whose uid ss avoids to mention :) even in despite of it's being invoked by root itself. –  poige Apr 11 '12 at 14:13
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.