ss and netstat seem to not be working.

Adobe Flash RTMFP protocol creates a lots of UDP connections. I want to know, who is connected to me.

I can see intense data-send traffic from the monitor.

I can observe UDP packets flowing through my network card and know their destination.

But I just can't get it from netstat or ss.

netstat -n only shows some tcp connections.
ss -u doesn't show useful information either.

I can confidently say I caught some UDP packets sent to LAN targets which appear in the arp cache on my computer, but I can see no LAN address in netstat or ss.

  • I think you know, that flash is an obsolete and not particularly wonderful thingy today, but there are some special circumstances in your case, making it unfortunately unavoidable. – peterh - Reinstate Monica Jul 12 '17 at 16:17

UDP is a connectionless protocol. There are no persistent connections; that's what TCP is for. It's why you don;t see connections!

It's a bit like a text message versus a phone conversation. With UDP, a packet is lobbed onto the net in the hope it will get there. Each one is separate.

| improve this answer | |

Unlike with TCP where a socket must be bound to a 4-tuple before data transfer starts, a UDP application can bind a socket to a local port and then send/receive traffic to/from anywhere using that one socket.

However iptables can track UDP "connections" to allow for stateful firewalling. So if you have the iptables connection tracking modules loaded you can view a list of UDP connections your system knows about at /proc/net/ip_conntrack . The format of the file is discussed at https://stackoverflow.com/questions/16034698/details-of-proc-net-ip-conntrack-nf-conntrack

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.