How to see process ID of TCP?

Question

When I want to see the process ID for an application I do ps -aux | grep <application>. For example, when I do ps -aux | grep ssh I see the process ID for SSH.

But when I do ps -aux | grep tcp it outputs nothing, even though I am actively using internet.

How can I see process ID for TCP?

Answer 1

TCP isn't a process, but a stack or subsystem inside the kernel. It doesn't have a "process id", as such, although kernel threads doing work as part of its operation may do. The work needed to perform the work of the TCP stack is spread across multiple kthreads, kernel stacks of userspace processes, and elsewhere.

To see kworkers on your machine, for example:

% pgrep -af kworker | head
24 kworker/1:0H-events_highpri
30 kworker/2:0H-events_highpri
36 kworker/3:0H-events_highpri
42 kworker/4:0H-kblockd
48 kworker/5:0H-events_highpri
54 kworker/6:0H-events_highpri
60 kworker/7:0H-events_highpri
120 kworker/1:1H-events_highpri
121 kworker/0:1H-kblockd
151 kworker/7:1H-events_highpri

Some of these are dedicated to particular kinds of work, and some are more generally scoped. Since the TCP stack involves not only the network, but also the CPU scheduler, memory, and other resources, many different parts of the kernel may eventually be abstractly involved in making forward progress in processing TCP packets.

Answer 2

I assume here you've looked at ps -aux | grep ssh and seen systems on the SSH port (TCP port 22) and thought that's the match. It's actually matching on the program name which is called ssh.

What's next really depends on what you are trying to do. To see all processes that are using TCP, the tool you want is ss.

ss -atnp is possibly what you are after. This will show all a sockets that are TCP t numerically n and the process that opened it p. You will need to be root or use sudo to see processes you don't own, such as a webserver or ssh server.

This command answers things like "who is connecting to remote site X" or "who has port 1234 open".