User associated with a socket

I use ss -p to see TCP sockets information. But process info are not printed for some sockets. Below:

$ss -p4 State Recv-Q Send-Q Local Address:Port Peer Address:Port ESTAB 0 0 10.146.18.213:50368 199.7.59.72:http  But with sudo, I can see the process info: $ sudo ss -p4
State  Recv-Q  Send-Q  Local Address:Port   Peer Address:Port
ESTAB  0       0       10.146.18.213:50368  199.7.59.72:http      users:(("sshd",473,18))


With netstat -net, no root, I can see the user:

$netstat -net Active Internet connections (w/o servers) Proto Recv-Q Send-Q Local Address Foreign Address State User Inode tcp 0 0 10.146.18.213:50368 199.7.59.72:80 ESTABLISHED 222 3693189  My user id is 222: $ id -u
222


But ss shows process info only with root.

My questions are:

1. Why are there sockets with no user associated?
2. Are these sockets with no user subjected to the owner module matching of iptables?
-
Add the output of 'ss -p' to your question. Have you tried 'netstat -net' as root? –  Eli Rosencruft Apr 10 '12 at 14:56
I have added them. Does ss do it right way? –  fossilet Apr 11 '12 at 2:02
Why do you think iptables is relevant here? –  Mikel Apr 11 '12 at 3:37
I am trying match the SSH tunnel traffic using iptables owner module. Have not get it work and wondering about the reason. –  fossilet Apr 11 '12 at 12:12

You can use ss -e to get UID as well.
sshd is the process command name, not the user name. And 473 is the process id. –  fossilet Apr 11 '12 at 12:10
@fossilet, + actually, you can use ss -e to get UID as well. –  poige Apr 11 '12 at 13:56
@fossilet in other words, you were misled too since ss w/o -e shows not user name, but process name, which is hidden unless you're root or it's your own socket. –  poige Apr 11 '12 at 14:00
@fossilet, also my investigation shows that root is the only user whose uid ss avoids to mention :) even in despite of it's being invoked by root itself. –  poige Apr 11 '12 at 14:13