ss -lnp in server shows following information:

# ss -lnp
Recv-Q Send-Q                                                                                                            Local Address:Port                                                                                                              Peer Address:Port 
0      128                                                                                                                          :::22                                                                                                                          :::*      users:(("sshd",3847,4))
0      128                                                                                                                           *:22                                                                                                                           *:*      users:(("sshd",3847,3))
0      10                                                                                                                                                                                                                                     *:*      users:(("sendmail",1605,4))
0      128                                                                                                                                                                                                                                   *:*      users:(("snmpd",22765,8))
0      128                                                                                                                          :::80                                                                                                                          :::*      users:(("httpd2-prefork",15058,4),("httpd2-prefork",2235,4),("httpd2-prefork",1209,4))

According to output of ss one might think that Apache listens only on TCP port 80 on all the IPv6 addresses. Actually Apache also serves requests over IPv4. Why is that so? In addition, how is it possible that PIDs 15058, 2235 and 1209 all listen on same TCP port?

  • 1
    Which operating system are you using? Some accept both protocols on IPv6 sockets to make it easier for software developers. – Sander Steffann Oct 22 '15 at 10:01
  • Operating system is OpenSUSE 11.4(Linux kernel 2.6.37). – Martin Oct 23 '15 at 9:42

1) This is how Linux works (by default) if you listen for connections on an ipv6 port.

2) The processes share the same "socket", which was created and "bound" to port 80.

In this case it is shared because the processes forked (cloned) after opening the socket. This is exactly the same as forked processes inheriting open files. Like when you run ls, it inherits file descriptors from the shell, which includes a handle allowing it to write its output to the terminal. Unix treats lots of things as files :).

However it wouldn't be possible to bind a second socket to listen on the same port (no matter what process you are). (Pedantry: unless both processes use SO_REUSEPORT).

  • Thanks! Does this mean that server translates regular IPv4 packets to IPv4 mapped IPv6 packets and then passes those IPv6 addresses to :::80 socket? Later it translates Apache responses in a similar way from IPv4 mapped IPv6 addresses to IPv4 addresses? – Martin Oct 22 '15 at 14:04
  • 1
    That's right, it converts IPv4 addresses to/from IPv4 mapped IPv6 addresses. (I expect it just mangles the addresses, before/after the normal packet parsing/building). – sourcejedi Oct 23 '15 at 9:29
  • One last question- are multiple processes allowed to listen on same socket only in case those processes are forked from each other? I mean for example if I configure sshd to listen on TCP port 22 and then ask httpd to listen on TCP port 22, then httpd is not able to bind to this socket as it is already in use. – Martin Oct 23 '15 at 9:52
  • 1
    You don't bind to a socket. You bind a socket to a port, and you can't bind a second socket to the same port. But you can inherit sockets (and pass them around). /revises answer. Ah, unfortunately my answer said "bind to a socket". I think it should be clearer now, sorry about that. – sourcejedi Oct 24 '15 at 13:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.