Bounty Ended with 100 reputation awarded by Stéphane Chazelas
2 added 1321 characters in body
source | link

Beyond what's available in the man page for ss I didn't find a whole lot of documentation about this tool. Worse there doesn't appear to be any guide or mention anywhere as to any details about what gets dumped out in the file when you use the -D switch.

I did find this document, SS Utility: Quick Intro, but it makes rally no meaningful mention of the -D switch. NOTE: This document appears t obe authored by the creator of ss, and the source for this document is maintained as part of the source tree.

Looking through the source tree (kernel.org or github), the function that does the work of writing this file out are contained within, but it's not that easy to tease out what's going on.

I ended up opening an issue on github asking this question over there to see if the developer can shed some light on this.

UPDATE #1

The author got back to my issue and stated that the file format is called netlink.

The file is in netlink format; ie. format the netlink message format used when iproute and related commands interact with kernel.

Details on the file format are covered in this RFC3549, titled: Linux Netlink as an IP Services Protocol. I also found this HOWTO titled: Generic Netlink HOW-TO based on Jamal's original doc, which may be helpful as well. A howto is also maintained on the linuxfoundation's website, titled: generic_netlink_howto.

The author also suggested using the library libmnl when attempting to parse files containing netlink information.

Look at libmnl as best way to handle/parse netlink.

Documentation on this library is kept here: libmnl Documentation. The project page for libmnl is kept under the netfilter.org site as a sub project. The web interface to its git repository is accessible as well.

Beyond what's available in the man page for ss I didn't find a whole lot of documentation about this tool. Worse there doesn't appear to be any guide or mention anywhere as to any details about what gets dumped out in the file when you use the -D switch.

I did find this document, SS Utility: Quick Intro, but it makes rally no meaningful mention of the -D switch. NOTE: This document appears t obe authored by the creator of ss, and the source for this document is maintained as part of the source tree.

Looking through the source tree (kernel.org or github), the function that does the work of writing this file out are contained within, but it's not that easy to tease out what's going on.

I ended up opening an issue on github asking this question over there to see if the developer can shed some light on this.

Beyond what's available in the man page for ss I didn't find a whole lot of documentation about this tool. Worse there doesn't appear to be any guide or mention anywhere as to any details about what gets dumped out in the file when you use the -D switch.

I did find this document, SS Utility: Quick Intro, but it makes rally no meaningful mention of the -D switch. NOTE: This document appears t obe authored by the creator of ss, and the source for this document is maintained as part of the source tree.

Looking through the source tree (kernel.org or github), the function that does the work of writing this file out are contained within, but it's not that easy to tease out what's going on.

I ended up opening an issue on github asking this question over there to see if the developer can shed some light on this.

UPDATE #1

The author got back to my issue and stated that the file format is called netlink.

The file is in netlink format; ie. format the netlink message format used when iproute and related commands interact with kernel.

Details on the file format are covered in this RFC3549, titled: Linux Netlink as an IP Services Protocol. I also found this HOWTO titled: Generic Netlink HOW-TO based on Jamal's original doc, which may be helpful as well. A howto is also maintained on the linuxfoundation's website, titled: generic_netlink_howto.

The author also suggested using the library libmnl when attempting to parse files containing netlink information.

Look at libmnl as best way to handle/parse netlink.

Documentation on this library is kept here: libmnl Documentation. The project page for libmnl is kept under the netfilter.org site as a sub project. The web interface to its git repository is accessible as well.

1
source | link

Beyond what's available in the man page for ss I didn't find a whole lot of documentation about this tool. Worse there doesn't appear to be any guide or mention anywhere as to any details about what gets dumped out in the file when you use the -D switch.

I did find this document, SS Utility: Quick Intro, but it makes rally no meaningful mention of the -D switch. NOTE: This document appears t obe authored by the creator of ss, and the source for this document is maintained as part of the source tree.

Looking through the source tree (kernel.org or github), the function that does the work of writing this file out are contained within, but it's not that easy to tease out what's going on.

I ended up opening an issue on github asking this question over there to see if the developer can shed some light on this.