The ss command (from the iproute2 set of tools which comes as a newer alternative to netstat) has in its --help the following options

   -0, --packet        display PACKET sockets
   -t, --tcp           display only TCP sockets
   -S, --sctp          display only SCTP sockets
   -u, --udp           display only UDP sockets
   -d, --dccp          display only DCCP sockets
   -w, --raw           display only RAW sockets
   -x, --unix          display only Unix domain sockets

What exactly is the distinction made here between RAW and UNIX domain sockets?

And what actually are the PACKET sockets?


A raw socket is a network socket (AF_INET or AF_INET6 usually). It can be used to create raw IP packages which can be used for troubleshooting or to implement your own TCP implementation without using SOCK_STREAM:

Raw sockets allow new IPv4 protocols to be implemented in user space. A raw socket receives or sends the raw datagram not including link level headers. [raw(7)]

Tools like nmap use raw sockets in order to stop the TCP handshake after the initial SYN, SYN-ACK, as the TCP connection never completely established. As a network socket, it uses sockaddr_in for addresses.

However, the creation of raw sockets is usually restricted. Only privileged processes can create them.

A unix socket on the other hand is not a network socket (AF_UNIX). It's a local socket:

The AF_UNIX (also known as AF_LOCAL) socket family is used to communicate between processes on the same machine efficiently. [unix(7)]

It uses another address structure (sockaddr_un). It's a common way to implement two-way communication on a single system for inter-process communication without going through the network layer.

And packet sockets are raw packets at the driver level:

Packet sockets are used to receive or send raw packets at the device driver (OSI Layer 2) level. They allow the user to implement protocol modules in user space on top of the physical layer. [packet(7)]

The other sockets act on the network layer (OSI Layer 3) or higher. At that point, you're talking directly to your network interface's driver.

For more information see socket(2), ip(7), packet(7), raw(7), socket(7) and unix(7).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.