User associated with a socket

Question

I use ss -p to see TCP sockets information. But process info are not printed for some sockets. Below:

$ ss -p4
State  Recv-Q  Send-Q  Local Address:Port   Peer Address:Port
ESTAB  0       0       10.146.18.213:50368  199.7.59.72:http

But with sudo, I can see the process info:

$ sudo ss -p4
State  Recv-Q  Send-Q  Local Address:Port   Peer Address:Port
ESTAB  0       0       10.146.18.213:50368  199.7.59.72:http      users:(("sshd",473,18))

With netstat -net, no root, I can see the user:

$ netstat -net
Active Internet connections (w/o servers)
Proto Recv-Q Send-Q Local Address               Foreign Address             State       User       Inode
tcp        0      0 10.146.18.213:50368         199.7.59.72:80              ESTABLISHED 222        3693189

My user id is 222:

$ id -u
222

But ss shows process info only with root.

My questions are:

1. Why are there sockets with no user associated?
2. Are these sockets with no user subjected to the owner module matching of iptables?

Answer 1

I'd say your "sudo ss" shows connection related to user sshd, meanwhile "netstat -net" — to your own user. That's why netstat's version doesn't require sudo to find out the details regarding the socket.

You can use ss -e to get UID as well.