I install atop on Debian 9. It runs as a monitoring daemon.

Why is it listening on a raw socket? Raw sockets are used to generate arbitrary IPv4 packets or capture all packets read all packets for a given IP sub-protocol! But I don't think my atop and its logs show any information from reading packets. I don't even use netatop - and that would require a kernel module, which is not included in Debian. And I would be extremely surprised if any of the atop features involve sending raw IP packets.

$ sudo netstat -l --raw -ep
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       User       Inode      PID/Program name
raw        0      0   *               7           root       2427667    7353/atop

$ sudo ss -l --raw -p
State      Recv-Q Send-Q Local Address:Port    Peer Address:Port    
UNCONN     0      0      *:ipproto-255         *:*                  users:(("atop",pid=7353,fd=4))
  • Edited to strike an assumption which was incorrect. Also tag the kernel specifically, since this could potentially affect how to interpret netstat output, especially for raw sockets. – sourcejedi Nov 13 '18 at 20:35

The raw socket is opened only to read information like statistics from the netatop kernel module, using getsockopt() (eww). There is no code to read or write raw packets with this socket.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.