Questions tagged [ss]
ss is used to dump socket statistics. It allows showing information similar to netstat. It can display more TCP and state informations than other tools.
50
questions
0
votes
1
answer
289
views
Find out what process is listening on a specific port
For the first time in my life, I am unable to figure out what process is listening on a specific port in Linux :)
This is an Ubuntu Server 22.04 installation, running K8s. There is an ingress ...
- 101
0
votes
0
answers
606
views
Unable to connect to a listening tcp port 80, Iptables is not blocking it
I am trying to see if tcp port 80 is open on a debian 11 server. I logged into it using SSH and did curl -v telnet://localhost:80. It says connection refused. If I do the same with port 22, it shows ...
- 416
0
votes
0
answers
102
views
What does the ss output's port number for a unix domain socket mean?
For example, the 15240 below,
# ss -xpl | grep stdout
u_str LISTEN 0 4096 /run/systemd/journal/stdout 15240 * 0 users:(("systemd-journal",pid=254,fd=5),("systemd",pid=1,fd=...
- 505
2
votes
1
answer
515
views
Can a single unix domain socket connect to multiple peers simultaneously?
Since this is the socket that syslog's /dev/log is symlinked to, I expect there is at least one listening socket from systemd-journald, and possibly some additional connected ones, with different &...
- 505
-1
votes
2
answers
500
views
how to Find the port number according to PID [duplicate]
The following command can be used to find out which process is listening on a particular port:
netstat -ltnp | grep -w ':8011'
How can we do the opposite, find the port number according to PID ...
- 12.2k
0
votes
1
answer
622
views
How to show the "syn_sent" socket state on Linux in realtime?
I want to see the state "syn_sent" of socket in realtime during the connection process
ss or netstat or any command
I have tried those commands, but all fail
watch netstat -tnaop|grep -i syn
...
- 11.7k
0
votes
1
answer
224
views
Where in the filesystem can I get metadata about a socket?
I know lsof and ss provide metadata about connections. Where do they get it from?
For example, this represents a connection:
ls -al /proc/102922/fd/98
lrwx------ 1 me me 64 dic 21 06:06 /proc/102922/...
- 115
0
votes
1
answer
127
views
View extended stats for listening ports (using ss?)
With ss -tuiOp we can view extended stats for an outbound process, e.g.:
tcp ESTAB 0 0 192.168.68.108:32862 52.86.220....
- 115
0
votes
1
answer
226
views
Can I use ss and filter on PID and FD?
I'd like to be able to run ss and filter on PID=$(pgrep emacs) and FDs=(5u|6u|8u). Does ss support filtering on either (or both) of these? Or is the best option to compose with grep?
I'm currently ...
- 101
2
votes
2
answers
138
views
What is 0.0.0.0%virbr0?
I get the following line from ss -lun:
udp UNCONN 0 0 0.0.0.0%virbr0:67 0.0.0.0:* users:(("dnsmasq",pid=950,fd=3))
...
user422875
1
vote
1
answer
346
views
rhel + any best practice to minimize the CLOSE_WAIT sessions from linux side
when we perform the following cli on our rhel machine we get more then 600 CLOSE_WAIT lines
lsof -i tcp:8088 | grep CLOSE_WAIT
java 31100 yarn 385u IPv4 208022048 0t0 TCP master02.hgti.com:...
- 12.2k
0
votes
1
answer
216
views
how to know what the process that connected to my machine VIA specific port
with the following command I want to get which are the IP's that connected on my machine with port 8088
18.23.292.9 is machine that resource manager service is running on with port 8088
ss -tanp | ...
- 12.2k
2
votes
1
answer
276
views
iproute2 ss - not showing process/pid information if user is not the same user as listening process?
Is it normal behavior, or a bug, that when I run ss -nltp, I only see the process/pid information if the user I am running ss -nltp as is the same user as the listening process?
$ docker run -it --rm ...
- 133
1
vote
1
answer
433
views
Why do nmap, ss (netscan?) and lsof give different results?
I'm trying to understand which ports are actively listening (in use?) on my machine and don't really know what I'm doing. The three commands I've experimented with are nmap, ss (?netscan?) and lsof.
...
- 133
0
votes
0
answers
47
views
Tcp connection not seen on peer node
I got several nodes to run my software. After startup, I found tcp connection is abnormal between two nodes.
Assume A is the leader which is listening on port 1234, B should connect A.
On node B, use ...
- 101
2
votes
1
answer
7k
views
What does address 224.0.0.251:5353 represent?
I read some tutorials,they say that netstat is deprecated. I tried ss command. THis is the output
Netid State Recv-Q Send-Q Local Address:Port ...
- 23
0
votes
2
answers
400
views
What is the best and the efficient way of tracking whether Apache web server is up and running?
When I wanted to check whether the Apache web server is up and running on the linux server(CentOS), I came to two solutions by tracking through the ps command and ss command. Following I've tried:
ps -...
- 1
1
vote
1
answer
462
views
Calculate TCP memory usage (does not add up)
I am running a Debian GNU/Linux 9.5 (stretch) with kernel: 4.9.0-7-amd64.
I have found the culprit of a memory consumption problem I am facing to be an in-app mechanism for sending logs to FluentD ...
- 163
1
vote
0
answers
531
views
socket statistics (ss) program weird ipv6 listening socket address format
I have two services listening on TCP/IPv6 sockets, ssh and mysql. ss shows this:
$ ss -tl6
State Recv-Q Send-Q Local Address:Port Peer Address:Port
LISTEN 0 128 ...
- 452
1
vote
1
answer
234
views
iproute2 ss - exclude sockets bound to loopback addresses
often I take a look at listening sockets with ss -nlptu, this list often includes few/dozen socket bound on either an ipv4 or ipv6 loopback address. As we know there are a few valid ipv4 loopback ...
- 4,144
4
votes
0
answers
233
views
Is there a command like `time` that monitors the network traffic of commands?
I can use the time command to measure the time some command takes:
time node -e ""
node -e "" 0.06s user 0.01s system 92% cpu 0.076 total
Is there a similar way to measure a ...
- 1,423
2
votes
0
answers
676
views
ss showing socket stuck in SYN-SENT with no traceable PID
On a client I see the following:
[root@redacted_local ~]# ss | grep -i syn
SYN-SENT 0 1 redacted_local_ip:792 redacted_server_ip:nfs
...
- 1,582
-1
votes
1
answer
136
views
what are the options to close manual the port correctly or release the port on rhel machines?
we have redhat 7.5 server
we are suspect that port 50070 not closed correctly by the service , ( we check by netstat and PID not found ) but from the log we can see that port is in use
so we try to do ...
- 12.2k
1
vote
2
answers
1k
views
How can I confirm which process is connect to remote port?
My loacl server IP is 192.168.122.100, and remote server IP is 192.168.122.50. I need to kill all processes which connect to 192.168.122.50:56666. By executing ss comand, I found there are three TCP ...
- 385
1
vote
2
answers
2k
views
'ss' shows multiple listening pids for same port
We have sh scripts using 'netstat' in our production code. We use command 'netstat -lntup' to retrieve all the pids which are listening to some port. I replaced the command with 'ss -lntup. Now, for ...
- 123
4
votes
2
answers
4k
views
What is the alternative of netstat in linux? [duplicate]
'netstat' is deprecated for Linux os. So I am looking for the right alternative of the 'netstat', So what will be right alternative for netstat?
I found out one 'SS' command but it is not sufficient ...
- 41
1
vote
1
answer
253
views
How to make ss show the user who is using the socket?
I want to know which user launched the process that is using a TCP socket.
I tried with ss -nte, but it only shows the uid, not the user's name. Is there a way to make ss show the user's name?
Here ...
- 798
2
votes
1
answer
123
views
How to decipher ss -t command output?
I am struggling with Node.js app deployment because of some CORS and port issues.
ss-t output
ESTAB 0 0 ...
- 1,441
3
votes
1
answer
332
views
Why ss -e doesn't show uid?
I have a debian VM, here the info:
las@Client:~$ cat /etc/os-release
PRETTY_NAME="Debian GNU/Linux 8 (jessie)"
NAME="Debian GNU/Linux"
VERSION_ID="8"
VERSION="8 (jessie)"
When I type ss -nte I ...
- 798
5
votes
5
answers
3k
views
How to continuously monitor PIDs connecting to local sockets?
Some local processes are connecting and disconnecting to 127.0.0.1 on port 1234.
I would like to log all connection to this port (or to server process).
I've tried
ss -tpn | grep 1234
It shows ...
- 143
0
votes
1
answer
147
views
How to prevent ss ouput with empty lines?
Moving from netstat to iproute2 ss I noticed that the output from ss tends to spill over into empty "new lines" when connecting via SSH from a cygwin terminal. e.g.:
user@host:~ $ ss -4t
State ...
- 101
10
votes
3
answers
16k
views
How to check whether a socket is listening or not?
I want to observe a socket status periodically, so I need to check the socket status by command.
Currently I list all listening sockets by ss and filter them by grep.
ss -l | grep -q /run/php/php7....
- 5,015
7
votes
2
answers
6k
views
Detailed output of ss command
I would want to know the meaning of some items in the ss command output. Eg:
# sudo ss -iepn '( dport = :3443 )'
Netid State Recv-Q Send-Q Local Address:Port ...
- 4,129
2
votes
0
answers
230
views
ss is slow when process option (-p) used
When checking for process listening on port using ss command, it's slow when compared with (obsolete) netstat command.
$ time ss -nlp | grep -E ':8081|:8007|:8010'
LISTEN 0 100 ...
- 124
1
vote
1
answer
449
views
What does the reordering field of ss --info mean?
ss --info returns information about tcp connections. It produces a line simliar to the following (some fields removed for formatting)
tcp ESTAB 0 0 192.168.1.177:60236 54.70.141.88:...
- 115
0
votes
1
answer
278
views
Conflicting "ss" commands on OpenSuse? [duplicate]
I have OpenSuse 15.1 "Magic Leap" installed.
I noticed that there seems to be two conflicting commands named ss.
When I run which ss, I get this:
/usr/sbin/ss
And when I try to inspect, notice ...
- 377
-4
votes
1
answer
167
views
What are the differences between `-f` and `-A` of `ss`?
What are the differences between -f and -A of ss?
Which of -f and -A is related to -t, -u, -4, -6, -w, -x?
Does -A inet,packet imply -A tcp,udp,raw?
I know a few socket concepts, but can't figure ...
- 95.9k
0
votes
2
answers
457
views
How can I find the mapping on `$DISPLAY` after `ssh -X`?
On machine B, I remote access machine C
$ ssh -X t@C
$ echo $DISPLAY
localhost:10.0
How can I find/verify the mapping of $DISPLAY on C to $DISPLAY on B? Can it be done by the following command ...
- 95.9k
2
votes
1
answer
1k
views
What do `<expire_time>` and `<retrans>` mean in the output of `ss -o`?
ss -o shows TCP timer in the following format:
timer:(<timer_name>,<expire_time>,<retrans>)
What do <expire_time> and <retrans> mean?
I found <expire_time> ...
- 95.9k
-1
votes
2
answers
10k
views
What is "inet prefix"?
$ ss 'state = established'
Error: an inet prefix is expected rather than "state".
Cannot parse dst/src address.
What is "inet prefix"?
What is a valid "inet prefix"?
- 95.9k
-1
votes
1
answer
1k
views
What is timer information shown by `ss -o`?
man ss says -o shows timer information. What is timer information? I can't tell it from ss -o and ss without -o. Thanks.
- 95.9k
0
votes
1
answer
397
views
Networking: port listening but nc fails
I have set up a docker-compose stack on a server.
One of its services is jaeger collector and is configured as follows:
collector:
image: jaegertracing/jaeger-collector:1.8
environment:
...
- 2,453
1
vote
1
answer
515
views
Why does atop open a raw socket?
I install atop on Debian 9. It runs as a monitoring daemon.
Why is it listening on a raw socket? Raw sockets are used to generate arbitrary IPv4 packets or capture all packets read all packets for ...
- 46.8k
1
vote
1
answer
4k
views
ss shows a raw socket. What does it mean that it is listening on "*:ipproto-255"?
What does ss mean by *:ipproto-255, in the local address/port column?
$ sudo ss -ap | grep -vE "^(nl |u_)"
Netid State Recv-Q Send-Q Local Address:Port Peer Address:Port
p_raw UNCONN 0 ...
- 46.8k
3
votes
1
answer
1k
views
what does the wildcard expression mean in command ss?
ss -lnt
State Recv-Q Send-Q Local Address:Port Peer Address:Port
LISTEN 0 128 127.0.0.53%lo:53 0.0.0.0:*
LISTEN 0 128 0....
- 183
0
votes
0
answers
1k
views
ss command: file descriptor information when using the -p option
In ss command, when using the -p option, this presumably provides info about the process (owner, pid an fd)
root@Cassiopeia:~# ss -tap | tail -1
ESTAB 0 0 [2a0i:527:9981:8511:f64e:...
- 2,453
3
votes
1
answer
2k
views
ss command: difference between raw and unix sockets
The ss command (from the iproute2 set of tools which comes as a newer alternative to netstat) has in its --help the following options
-0, --packet display PACKET sockets
-t, --tcp ...
- 2,453
5
votes
1
answer
1k
views
How can I sniff unix dgram socket without having file path?
From that article, I realized that:
a UNIX domain socket is bound to a file path.
So, I need to sniff DGRAM Unix socket through the socat as mentioned here. But when I try to retrieve the path for ...
- 275
2
votes
1
answer
2k
views
What is the difference between lsof vs lsof -i
One of my processes running on Debian server started throwing a socket: too many open files error. I then started debugging the error. I came through the following scenario.
When I ran lsof | grep ...
- 121
30
votes
3
answers
11k
views
ss - linux socket statistics utility output format
When using ss with -p option, user/pid/fd column jumps underneath the particular line. For instance this is it what I'm actually seeing:
# ss -nulp4
State Recv-Q Send-Q ...
- 2,216