SS, netstat, and tcpdump, to name a few programs, will all convert a port number to a name when recognized. So a connection on port 22 will instead be shown as 'ssh', as an example.

I'm wondering how this mapping is done? I assume that the programs aren't each hardcoding a list of mappings? Is there a central program or service responsible for helping networks map port number to name?

Related question, when I run SS on the same version of linux (6.9, so a bit old) I'm getting different behaviors. On the VM I was testing on the command 'ss -a' lists a program on port 11001; On a bare metal machine with the same OS & command the port is instead listed as metasys. It's easy enough to fix my script to get around the problem, but I'm curious why one serve recognizes port 11001 and the other doesn't.


Typically with the getservbyport() API which is an interface to the Name Service framework.

It's the same family of functions that resolve IP addresses to host names, user names to user ids and so on.

getservbyport() will typically look at /etc/nsswitch.conf (which lists which database to use for each of the category), for the entry for services.

If the entry for services shows files, then the /etc/services file as a flat text file will be used, like /etc/passwd would be used if files was mentioned for passwd (the user database).

You can have other forms of databases. On GNU systems, if there's a xyz database listed, it would be queried using a libnss_xyz.so shared library loaded on demand.

Other than files, common ones are db, nis, nisplus, ldap...

On simple deployments, it's usually only files, so /etc/services.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.