4

I use ss -p to see TCP sockets information. But process info are not printed for some sockets. Below:

$ ss -p4
State  Recv-Q  Send-Q  Local Address:Port   Peer Address:Port
ESTAB  0       0       10.146.18.213:50368  199.7.59.72:http

But with sudo, I can see the process info:

$ sudo ss -p4
State  Recv-Q  Send-Q  Local Address:Port   Peer Address:Port
ESTAB  0       0       10.146.18.213:50368  199.7.59.72:http      users:(("sshd",473,18))

With netstat -net, no root, I can see the user:

$ netstat -net
Active Internet connections (w/o servers)
Proto Recv-Q Send-Q Local Address               Foreign Address             State       User       Inode
tcp        0      0 10.146.18.213:50368         199.7.59.72:80              ESTABLISHED 222        3693189

My user id is 222:

$ id -u
222

But ss shows process info only with root.

My questions are:

  1. Why are there sockets with no user associated?
  2. Are these sockets with no user subjected to the owner module matching of iptables?
4
  • Add the output of 'ss -p' to your question. Have you tried 'netstat -net' as root? Apr 10, 2012 at 14:56
  • I have added them. Does ss do it right way? Apr 11, 2012 at 2:02
  • Why do you think iptables is relevant here?
    – Mikel
    Apr 11, 2012 at 3:37
  • I am trying match the SSH tunnel traffic using iptables owner module. Have not get it work and wondering about the reason. Apr 11, 2012 at 12:12

1 Answer 1

2

I'd say your "sudo ss" shows connection related to user sshd, meanwhile "netstat -net" — to your own user. That's why netstat's version doesn't require sudo to find out the details regarding the socket.

You can use ss -e to get UID as well.

5
  • sshd is the process command name, not the user name. And 473 is the process id. Apr 11, 2012 at 12:10
  • You said "But with sudo, I can see the user", that's why I thought it was username.
    – poige
    Apr 11, 2012 at 13:49
  • @fossilet, + actually, you can use ss -e to get UID as well.
    – poige
    Apr 11, 2012 at 13:56
  • @fossilet in other words, you were misled too since ss w/o -e shows not user name, but process name, which is hidden unless you're root or it's your own socket.
    – poige
    Apr 11, 2012 at 14:00
  • @fossilet, also my investigation shows that root is the only user whose uid ss avoids to mention :) even in despite of it's being invoked by root itself.
    – poige
    Apr 11, 2012 at 14:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .