Questions tagged [ss]

ss is used to dump socket statistics. It allows showing information similar to netstat. It can display more TCP and state informations than other tools.

Filter by
Sorted by
Tagged with
0
votes
2answers
33 views

What is the best and the efficient way of tracking whether Apache web server is up and running?

When I wanted to check whether the Apache web server is up and running on the linux server(CentOS), I came to two solutions by tracking through the ps command and ss command. Following I've tried: ps -...
0
votes
0answers
6 views

conflict : watching in realtime opened ports without line wrap

How to monitor ports and connection in real time in Arch linux ? I can use watch combine with ss -tulpn, but when pipe it to less -S (to disable line wrap), the output is nothing. $sudo watch ss -...
1
vote
1answer
59 views

Calculate TCP memory usage (does not add up)

I am running a Debian GNU/Linux 9.5 (stretch) with kernel: 4.9.0-7-amd64. I have found the culprit of a memory consumption problem I am facing to be an in-app mechanism for sending logs to FluentD ...
1
vote
0answers
16 views

socket statistics (ss) program weird ipv6 listening socket address format

I have two services listening on TCP/IPv6 sockets, ssh and mysql. ss shows this: $ ss -tl6 State Recv-Q Send-Q Local Address:Port ...
0
votes
0answers
15 views

What is the equivalent of netstat -s with the ss command? [duplicate]

I am trying to debug network errors on a container running in kubernetes. I don't have root or sudo, so I am trying to use the ss command. netstat would be better but I can't install it. I am trying ...
1
vote
1answer
50 views

iproute2 ss - exclude sockets bound to loopback addresses

often I take a look at listening sockets with ss -nlptu, this list often includes few/dozen socket bound on either an ipv4 or ipv6 loopback address. As we know there are a few valid ipv4 loopback ...
4
votes
0answers
51 views

Is there a command like `time` that monitors the network traffic of commands?

I can use the time command to measure the time some command takes: time node -e "" node -e "" 0.06s user 0.01s system 92% cpu 0.076 total Is there a similar way to measure a ...
0
votes
0answers
102 views

ss showing socket stuck in SYN-SENT with no traceable PID

On a client I see the following: [root@redacted_local ~]# ss | grep -i syn SYN-SENT 0 1 redacted_local_ip:792 redacted_server_ip:nfs ...
-1
votes
1answer
39 views

what are the options to close manual the port correctly or release the port on rhel machines?

we have redhat 7.5 server we are suspect that port 50070 not closed correctly by the service , ( we check by netstat and PID not found ) but from the log we can see that port is in use so we try to do ...
0
votes
2answers
32 views

How can I confirm which process is connect to remote port?

My loacl server IP is 192.168.122.100, and remote server IP is 192.168.122.50. I need to kill all processes which connect to 192.168.122.50:56666. By executing ss comand, I found there are three TCP ...
1
vote
2answers
340 views

'ss' shows multiple listening pids for same port

We have sh scripts using 'netstat' in our production code. We use command 'netstat -lntup' to retrieve all the pids which are listening to some port. I replaced the command with 'ss -lntup. Now, for ...
4
votes
2answers
480 views

What is the alternative of netstat in linux? [duplicate]

'netstat' is deprecated for Linux os. So I am looking for the right alternative of the 'netstat', So what will be right alternative for netstat? I found out one 'SS' command but it is not sufficient ...
1
vote
1answer
57 views

How to make ss show the user who is using the socket?

I want to know which user launched the process that is using a TCP socket. I tried with ss -nte, but it only shows the uid, not the user's name. Is there a way to make ss show the user's name? Here ...
0
votes
0answers
35 views

`ss -tap` with empty 'Process' column - who's the owner?

Who owns the sockets with empty Process column in ss -tap? Does the kernel (rather than kernel processes) directly own these?
2
votes
1answer
51 views

How to decipher ss -t command output?

I am struggling with Node.js app deployment because of some CORS and port issues. ss-t output ESTAB 0 0 ...
3
votes
1answer
118 views

Why ss -e doesn't show uid?

I have a debian VM, here the info: las@Client:~$ cat /etc/os-release PRETTY_NAME="Debian GNU/Linux 8 (jessie)" NAME="Debian GNU/Linux" VERSION_ID="8" VERSION="8 (jessie)" When I type ss -nte I ...
5
votes
5answers
842 views

How to continuously monitor PIDs connecting to local sockets?

Some local processes are connecting and disconnecting to 127.0.0.1 on port 1234. I would like to log all connection to this port (or to server process). I've tried ss -tpn | grep 1234 It shows ...
0
votes
1answer
50 views

How to prevent ss ouput with empty lines?

Moving from netstat to iproute2 ss I noticed that the output from ss tends to spill over into empty "new lines" when connecting via SSH from a cygwin terminal. e.g.: user@host:~ $ ss -4t State ...
6
votes
3answers
4k views

How to check whether a socket is listening or not?

I want to observe a socket status periodically, so I need to check the socket status by command. Currently I list all listening sockets by ss and filter them by grep. ss -l | grep -q /run/php/php7....
5
votes
2answers
2k views

Detailed output of ss command

I would want to know the meaning of some items in the ss command output. Eg: # sudo ss -iepn '( dport = :3443 )' Netid State Recv-Q Send-Q Local Address:Port ...
2
votes
0answers
74 views

ss is slow when process option (-p) used

When checking for process listening on port using ss command, it's slow when compared with (obsolete) netstat command. $ time ss -nlp | grep -E ':8081|:8007|:8010' LISTEN 0 100 ...
1
vote
1answer
185 views

What does the reordering field of ss --info mean?

ss --info returns information about tcp connections. It produces a line simliar to the following (some fields removed for formatting) tcp ESTAB 0 0 192.168.1.177:60236 54.70.141.88:...
0
votes
1answer
111 views

Conflicting “ss” commands on OpenSuse? [duplicate]

I have OpenSuse 15.1 "Magic Leap" installed. I noticed that there seems to be two conflicting commands named ss. When I run which ss, I get this: /usr/sbin/ss And when I try to inspect, notice ...
-5
votes
1answer
108 views

What are the differences between `-f` and `-A` of `ss`?

What are the differences between -f and -A of ss? Which of -f and -A is related to -t, -u, -4, -6, -w, -x? Does -A inet,packet imply -A tcp,udp,raw? I know a few socket concepts, but can't figure ...
0
votes
2answers
220 views

How can I find the mapping on `$DISPLAY` after `ssh -X`?

On machine B, I remote access machine C $ ssh -X t@C $ echo $DISPLAY localhost:10.0 How can I find/verify the mapping of $DISPLAY on C to $DISPLAY on B? Can it be done by the following command ...
2
votes
1answer
725 views

What do `<expire_time>` and `<retrans>` mean in the output of `ss -o`?

ss -o shows TCP timer in the following format: timer:(<timer_name>,<expire_time>,<retrans>) What do <expire_time> and <retrans> mean? I found <expire_time> ...
-1
votes
2answers
6k views

What is “inet prefix”?

$ ss 'state = established' Error: an inet prefix is expected rather than "state". Cannot parse dst/src address. What is "inet prefix"? What is a valid "inet prefix"?
-2
votes
1answer
404 views

What is timer information shown by `ss -o`?

man ss says -o shows timer information. What is timer information? I can't tell it from ss -o and ss without -o. Thanks.
0
votes
1answer
225 views

Networking: port listening but nc fails

I have set up a docker-compose stack on a server. One of its services is jaeger collector and is configured as follows: collector: image: jaegertracing/jaeger-collector:1.8 environment: ...
0
votes
1answer
273 views

Why does atop open a raw socket?

I install atop on Debian 9. It runs as a monitoring daemon. Why is it listening on a raw socket? Raw sockets are used to generate arbitrary IPv4 packets or capture all packets read all packets for ...
0
votes
1answer
2k views

ss shows a raw socket. What does it mean that it is listening on “*:ipproto-255”?

What does ss mean by *:ipproto-255, in the local address/port column? $ sudo ss -ap | grep -vE "^(nl |u_)" Netid State Recv-Q Send-Q Local Address:Port Peer Address:Port p_raw UNCONN 0 ...
1
vote
1answer
361 views

what does the wildcard expression mean in command ss?

ss -lnt State Recv-Q Send-Q Local Address:Port Peer Address:Port LISTEN 0 128 127.0.0.53%lo:53 0.0.0.0:* LISTEN 0 128 0....
0
votes
0answers
730 views

ss command: file descriptor information when using the -p option

In ss command, when using the -p option, this presumably provides info about the process (owner, pid an fd) root@Cassiopeia:~# ss -tap | tail -1 ESTAB 0 0 [2a0i:527:9981:8511:f64e:...
3
votes
1answer
1k views

ss command: difference between raw and unix sockets

The ss command (from the iproute2 set of tools which comes as a newer alternative to netstat) has in its --help the following options -0, --packet display PACKET sockets -t, --tcp ...
5
votes
1answer
808 views

How can I sniff unix dgram socket without having file path?

From that article, I realized that: a UNIX domain socket is bound to a file path. So, I need to sniff DGRAM Unix socket through the socat as mentioned here. But when I try to retrieve the path for ...
2
votes
1answer
945 views

What is the difference between lsof vs lsof -i

One of my processes running on Debian server started throwing a socket: too many open files error. I then started debugging the error. I came through the following scenario. When I ran lsof | grep ...
26
votes
2answers
9k views

ss - linux socket statistics utility output format

When using ss with -p option, user/pid/fd column jumps underneath the particular line. For instance this is it what I'm actually seeing: # ss -nulp4 State Recv-Q Send-Q ...