Network monitoring tools ss, lsof -i, netstat -ltupw and similar have limitations like namespace and thus they don't show the whole machine connections. (for namespace created with ip we can see other connections with ip -all netns exec ss).

The kernel state the connections here /proc/net/tcp[udp][raw] and namespace connections can be seen here /proc/$pid/net/tcp[udp][raw] (detail)

What are the other possible connections that are not seen by ss/lsof/netstat and how to monitor them?

  • 1
    I guess that a start of an answer would be 1. connection outside the kernel like Intel me 2. namespaces 3. other kernel modules that would use a particular interface... – intika Jun 3 '19 at 13:03
  • 2
    Any connection created via raw sockets? the sockets will appear in the info obtained with sock_diag (as used by ss, etc), but not the "connections" an app may build on top of them. Your question is too open-ended, so I doubt that any adequate answer can be made. The only true way is to capture all the packets on the wire and look at them. – Uncle Billy Jun 3 '19 at 13:22
  • Raw ip packets and raw ethernet packets both use the kernel socket and thus are visible to the listed tools, indeed an application can build its own protocol on top of a raw socket but nevertheless the raw connection is visible. i don't think the question is broad it ask for what is not visible for the usual monitoring tool. – intika Jun 3 '19 at 15:53
  • 2
    @intika You likely know more than me but maybe this is helpful: 1) NFQUEUE can reveal connections as they happen, but it might be tricky to set up and not miss anything (OpenSnitch has a number of closed issues covering that part, although I'm not sure if there's anything about Layer2 there) 2) I'm guessing that kernel extensions are able to make unnoticed connections if they talk directly to NIC (not directly applicable on Linux, but I'm observing something like this on a Mac, where VirtualBox is able to bypass Little Snitch when in bridged mode). – Tomasz Zieliński Jun 3 '19 at 16:28
  • 3
    Very fast connections - those are not going to be visible. If you're doing something like watch -n1 ss you won't see connections established and closed within less than 1 second. – Sergiy Kolodyazhnyy Jun 3 '19 at 18:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.