What does ss mean by *:ipproto-255, in the local address/port column?

$ sudo ss -ap | grep -vE "^(nl |u_)"
Netid  State     Recv-Q Send-Q  Local Address:Port  Peer Address:Port
p_raw  UNCONN    0      0        *:eth0               *                 users:(("lldpd",pid=742,fd=11))
raw    UNCONN    0      0        *:icmp              *:*                users:(("ping",pid=9077,fd=3))
raw    UNCONN    0      0        *:ipproto-255       *:*                users:(("atop",pid=7353,fd=4))
raw    UNCONN    0      0       :::ipv6-icmp        :::*                users:(("ping",pid=9077,fd=4))
udp    UNCONN    0      0        *:syslog            *:*                users:(("rsyslogd",pid=495,fd=5))

If you want to know what it looks like in netstat, it shows up as

$ sudo netstat -l --raw -ep
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       User       Inode      PID/Program name
raw        0      0   *               7           root       2427667    7353/atop

255 is the value of IPPROTO_RAW. It means this socket allows sending all types of IPv4 packets. (It cannot receive packets). The program has to provide a full IPv4 header.

For comparison, the raw socket with *:icmp allows sending and receiving IPv4 packets which use the ICMP protocol.

These details are specific to Linux. The exact behaviour of raw sockets varies between different Unix variants and versions.


The IPv4 protocol field has 255 possible values.


That said, I found this particular IPPRPROTO_RAW socket was not being used to send packets:

Why does atop open a raw socket?

  • /etc/protocols (protocols(5)) has the list of protocol numbers, too. On the command line you can use getent protocols name or getent protocols number, e.g. getent protocols tcp or getent protocols 6 which will return tcp 6 TCP. – Cristian Ciupitu Nov 13 '18 at 12:03
  • @CristianCiupitu I suspect ss used that method to show *:icmp. But the protocols file does not include 255 / IPPROTO_RAW. – sourcejedi Nov 13 '18 at 12:18
  • Same thing with the Wikipedia page, it says that 255 is "reserved for extra", not "raw". – Cristian Ciupitu Nov 13 '18 at 13:13
  • For what it's worth, the canonical list is hosted at IANA, not Wikipedia. – Cristian Ciupitu Nov 13 '18 at 13:14
  • @CristianCiupitu wiki is rich with clicky links etc. The citation is provided to show what I mean by the IP protocol / IP protocol field. It's useful to point to a very concrete definition in terms of bits... especially when we have two different contexts with different definitions for that bit pattern. The RFCs of old etc are good, but they're still reference specifications, not bitesize introductions. And wiki links to them! – sourcejedi Nov 13 '18 at 13:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.