I'm SSH'ed into a virtual machine and looking at /proc/<pid>/net/tcp for my zsh shell. I see this line

sl  local_address rem_address   st tx_queue rx_queue tr tm->when retrnsmt   uid  timeout inode
 3: 00000000:0016 00000000:0000 0A 00000000:00000000 00:00000000 00000000     0        0 19127 1 0000000000000000 100 0 0 10 0

Unless I'm misunderstanding what this is saying, zsh is listening on port 22. I know that the zsh process is a descendant of the process running sshd but wouldn't sshd have closed the listening socket after forking?


1 Answer 1


Why is zsh listening on port 22?

It is not. Instead you are interpreting the shown information wrongly: /proc/pid/net/ shows network information about the full namespace the process is in, i.e. not only connections held open by the specific process. You might want to use lsof -n -p pid instead.

  • 1
    Or just use netstat and/or ss with the -p option (which shows for your process the pid of a listening socket or if you are root for all)
    – eckes
    Apr 24, 2022 at 19:52
  • To-do: Learn about namespaces. Thanks! Apr 24, 2022 at 22:08
  • 3
    @DanielWalker Note that this doesn't have much to do with network namespaces. On a system without network namespaces, /proc/pid/net simply shows the whole system.
    – TooTea
    Apr 25, 2022 at 7:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .