1

I want to know which user launched the process that is using a TCP socket.

I tried with ss -nte, but it only shows the uid, not the user's name. Is there a way to make ss show the user's name? Here the output of ss -nte

lucio@debian:~$ ss -nte
State            Recv-Q            Send-Q                        Local Address:Port                           Peer Address:Port                                                                                    
ESTAB            0                 0                              192.168.56.1:45414                        192.168.56.201:22               timer:(keepalive,46min,0) uid:1000 ino:711653 sk:4 <->                 
ESTAB            0                 0                              192.168.56.1:35544                        192.168.56.203:22               timer:(keepalive,46min,0) uid:1000 ino:713505 sk:12 <->                
ESTAB            0                 0                            192.168.178.70:55342                        151.101.193.69:443              uid:1000 ino:758973 sk:3a <->                                          
ESTAB            0                 0                            192.168.178.70:41212                        198.252.206.25:443              timer:(keepalive,7min4sec,0) uid:1000 ino:756177 sk:3b <->             
ESTAB            0                 0                              192.168.56.1:45542                        192.168.56.202:22               timer:(keepalive,46min,0) uid:1000 ino:715991 sk:1e <->                
ESTAB            0                 0                            192.168.178.70:41196                        198.252.206.25:443              timer:(keepalive,6min19sec,0) uid:1000 ino:756063 sk:3c <->            
ESTAB            0                 0                            192.168.178.70:43372                         216.58.205.78:443              uid:1000 ino:759631 sk:3d <->  
5
  • 1
    Try ss -ntep ? – steve May 9 '20 at 14:48
  • 1
    @steve -p shows the process, not the user that causes the process – Francesco Lucianò May 9 '20 at 15:03
  • Given the process` pid, you can find who owns the process with ps -o user -p <pid> – Andy Dalton May 9 '20 at 15:10
  • @AndyDalton I know this, but my question is "can I have the username only with ss with some option"? I could have used the uid to find the username, too. – Francesco Lucianò May 9 '20 at 15:13
  • 1
    As far I can can see, no, you cannot. The closest thing I see the the -e option, which will include the uid of the user (not the username). – Andy Dalton May 9 '20 at 15:19
2

Hacky attempt to bring in perl to help. See how it replaces the uid:1001 with user:bob.

# ss -ntel
State          Recv-Q          Send-Q                    Local Address:Port                     Peer Address:Port
LISTEN         0               10                              0.0.0.0:12345                         0.0.0.0:*              uid:1001 ino:29109 sk:5e <->
LISTEN         0               100                           127.0.0.1:25                            0.0.0.0:*              ino:18771 sk:2 <->
LISTEN         0               128                             0.0.0.0:111                           0.0.0.0:*              ino:16606 sk:3 <->
LISTEN         0               128                             0.0.0.0:22                            0.0.0.0:*              ino:20128 sk:4 <->
LISTEN         0               10                                 [::]:12345                            [::]:*              uid:1001 ino:29108 sk:61 v6only:1 <->
LISTEN         0               128                                [::]:111                              [::]:*              ino:16609 sk:5 v6only:1 <->
LISTEN         0               128                                   *:80                                  *:*              ino:18314 sk:6 v6only:0 <->
LISTEN         0               128                                [::]:22                               [::]:*              ino:20130 sk:7 v6only:1 <->
# ss -ntel|perl -pne 'if(/uid:(\d+)/){@a=getpwuid($1);s/uid:(\d+)/user:$a[0]/}'
State    Recv-Q    Send-Q        Local Address:Port        Peer Address:Port
LISTEN   0         10                  0.0.0.0:12345            0.0.0.0:*        user:bob ino:29109 sk:5e <->
LISTEN   0         100               127.0.0.1:25               0.0.0.0:*        ino:18771 sk:2 <->
LISTEN   0         128                 0.0.0.0:111              0.0.0.0:*        ino:16606 sk:3 <->
LISTEN   0         128                 0.0.0.0:22               0.0.0.0:*        ino:20128 sk:4 <->
LISTEN   0         10                     [::]:12345               [::]:*        user:bob ino:29108 sk:61 v6only:1 <->
LISTEN   0         128                    [::]:111                 [::]:*        ino:16609 sk:5 v6only:1 <->
LISTEN   0         128                       *:80                     *:*        ino:18314 sk:6 v6only:0 <->
LISTEN   0         128                    [::]:22                  [::]:*        ino:20130 sk:7 v6only:1 <->
#

Note : I've checked the source and there doesn't appear to be anything native within ss to achieve this.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.