3

I use ss -p to see TCP sockets information. But process info are not printed for some sockets. Below:

$ ss -p4
State  Recv-Q  Send-Q  Local Address:Port   Peer Address:Port
ESTAB  0       0       10.146.18.213:50368  199.7.59.72:http

But with sudo, I can see the process info:

$ sudo ss -p4
State  Recv-Q  Send-Q  Local Address:Port   Peer Address:Port
ESTAB  0       0       10.146.18.213:50368  199.7.59.72:http      users:(("sshd",473,18))

With netstat -net, no root, I can see the user:

$ netstat -net
Active Internet connections (w/o servers)
Proto Recv-Q Send-Q Local Address               Foreign Address             State       User       Inode
tcp        0      0 10.146.18.213:50368         199.7.59.72:80              ESTABLISHED 222        3693189

My user id is 222:

$ id -u
222

But ss shows process info only with root.

My questions are:

  1. Why are there sockets with no user associated?
  2. Are these sockets with no user subjected to the owner module matching of iptables?
  • Add the output of 'ss -p' to your question. Have you tried 'netstat -net' as root? – Eli Rosencruft Apr 10 '12 at 14:56
  • I have added them. Does ss do it right way? – Fish Monitor Apr 11 '12 at 2:02
  • Why do you think iptables is relevant here? – Mikel Apr 11 '12 at 3:37
  • I am trying match the SSH tunnel traffic using iptables owner module. Have not get it work and wondering about the reason. – Fish Monitor Apr 11 '12 at 12:12
1

I'd say your "sudo ss" shows connection related to user sshd, meanwhile "netstat -net" — to your own user. That's why netstat's version doesn't require sudo to find out the details regarding the socket.

You can use ss -e to get UID as well.

  • sshd is the process command name, not the user name. And 473 is the process id. – Fish Monitor Apr 11 '12 at 12:10
  • You said "But with sudo, I can see the user", that's why I thought it was username. – poige Apr 11 '12 at 13:49
  • @fossilet, + actually, you can use ss -e to get UID as well. – poige Apr 11 '12 at 13:56
  • @fossilet in other words, you were misled too since ss w/o -e shows not user name, but process name, which is hidden unless you're root or it's your own socket. – poige Apr 11 '12 at 14:00
  • @fossilet, also my investigation shows that root is the only user whose uid ss avoids to mention :) even in despite of it's being invoked by root itself. – poige Apr 11 '12 at 14:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.