Questions tagged [ss]

ss is used to dump socket statistics. It allows showing information similar to netstat. It can display more TCP and state informations than other tools.

Filter by
Sorted by
Tagged with
27
votes
3answers
10k views

ss - linux socket statistics utility output format

When using ss with -p option, user/pid/fd column jumps underneath the particular line. For instance this is it what I'm actually seeing: # ss -nulp4 State Recv-Q Send-Q ...
7
votes
2answers
3k views

Detailed output of ss command

I would want to know the meaning of some items in the ss command output. Eg: # sudo ss -iepn '( dport = :3443 )' Netid State Recv-Q Send-Q Local Address:Port ...
6
votes
5answers
2k views

How to continuously monitor PIDs connecting to local sockets?

Some local processes are connecting and disconnecting to 127.0.0.1 on port 1234. I would like to log all connection to this port (or to server process). I've tried ss -tpn | grep 1234 It shows ...
6
votes
3answers
8k views

How to check whether a socket is listening or not?

I want to observe a socket status periodically, so I need to check the socket status by command. Currently I list all listening sockets by ss and filter them by grep. ss -l | grep -q /run/php/php7....
5
votes
1answer
1k views

How can I sniff unix dgram socket without having file path?

From that article, I realized that: a UNIX domain socket is bound to a file path. So, I need to sniff DGRAM Unix socket through the socat as mentioned here. But when I try to retrieve the path for ...
4
votes
2answers
1k views

What is the alternative of netstat in linux? [duplicate]

'netstat' is deprecated for Linux os. So I am looking for the right alternative of the 'netstat', So what will be right alternative for netstat? I found out one 'SS' command but it is not sufficient ...
4
votes
0answers
77 views

Is there a command like `time` that monitors the network traffic of commands?

I can use the time command to measure the time some command takes: time node -e "" node -e "" 0.06s user 0.01s system 92% cpu 0.076 total Is there a similar way to measure a ...
3
votes
1answer
192 views

Why ss -e doesn't show uid?

I have a debian VM, here the info: las@Client:~$ cat /etc/os-release PRETTY_NAME="Debian GNU/Linux 8 (jessie)" NAME="Debian GNU/Linux" VERSION_ID="8" VERSION="8 (jessie)" When I type ss -nte I ...
3
votes
1answer
1k views

ss command: difference between raw and unix sockets

The ss command (from the iproute2 set of tools which comes as a newer alternative to netstat) has in its --help the following options -0, --packet display PACKET sockets -t, --tcp ...
2
votes
1answer
66 views

How to decipher ss -t command output?

I am struggling with Node.js app deployment because of some CORS and port issues. ss-t output ESTAB 0 0 ...
2
votes
1answer
659 views

what does the wildcard expression mean in command ss?

ss -lnt State Recv-Q Send-Q Local Address:Port Peer Address:Port LISTEN 0 128 127.0.0.53%lo:53 0.0.0.0:* LISTEN 0 128 0....
2
votes
1answer
1k views

What is the difference between lsof vs lsof -i

One of my processes running on Debian server started throwing a socket: too many open files error. I then started debugging the error. I came through the following scenario. When I ran lsof | grep ...
2
votes
2answers
52 views

What is 0.0.0.0%virbr0?

I get the following line from ss -lun: udp UNCONN 0 0 0.0.0.0%virbr0:67 0.0.0.0:* users:(("dnsmasq",pid=950,fd=3)) ...
2
votes
1answer
961 views

What do `<expire_time>` and `<retrans>` mean in the output of `ss -o`?

ss -o shows TCP timer in the following format: timer:(<timer_name>,<expire_time>,<retrans>) What do <expire_time> and <retrans> mean? I found <expire_time> ...
2
votes
0answers
115 views

ss is slow when process option (-p) used

When checking for process listening on port using ss command, it's slow when compared with (obsolete) netstat command. $ time ss -nlp | grep -E ':8081|:8007|:8010' LISTEN 0 100 ...
1
vote
1answer
95 views

iproute2 ss - exclude sockets bound to loopback addresses

often I take a look at listening sockets with ss -nlptu, this list often includes few/dozen socket bound on either an ipv4 or ipv6 loopback address. As we know there are a few valid ipv4 loopback ...
1
vote
1answer
95 views

How to make ss show the user who is using the socket?

I want to know which user launched the process that is using a TCP socket. I tried with ss -nte, but it only shows the uid, not the user's name. Is there a way to make ss show the user's name? Here ...
1
vote
1answer
3k views

ss shows a raw socket. What does it mean that it is listening on "*:ipproto-255"?

What does ss mean by *:ipproto-255, in the local address/port column? $ sudo ss -ap | grep -vE "^(nl |u_)" Netid State Recv-Q Send-Q Local Address:Port Peer Address:Port p_raw UNCONN 0 ...
1
vote
1answer
43 views

rhel + any best practice to minimize the CLOSE_WAIT sessions from linux side

when we perform the following cli on our rhel machine we get more then 600 CLOSE_WAIT lines lsof -i tcp:8088 | grep CLOSE_WAIT java 31100 yarn 385u IPv4 208022048 0t0 TCP master02.hgti.com:...
1
vote
1answer
30 views

iproute2 ss - not showing process/pid information if user is not the same user as listening process?

Is it normal behavior, or a bug, that when I run ss -nltp, I only see the process/pid information if the user I am running ss -nltp as is the same user as the listening process? $ docker run -it --rm ...
1
vote
2answers
851 views

'ss' shows multiple listening pids for same port

We have sh scripts using 'netstat' in our production code. We use command 'netstat -lntup' to retrieve all the pids which are listening to some port. I replaced the command with 'ss -lntup. Now, for ...
1
vote
1answer
271 views

What does the reordering field of ss --info mean?

ss --info returns information about tcp connections. It produces a line simliar to the following (some fields removed for formatting) tcp ESTAB 0 0 192.168.1.177:60236 54.70.141.88:...
1
vote
1answer
164 views

Calculate TCP memory usage (does not add up)

I am running a Debian GNU/Linux 9.5 (stretch) with kernel: 4.9.0-7-amd64. I have found the culprit of a memory consumption problem I am facing to be an in-app mechanism for sending logs to FluentD ...
1
vote
0answers
142 views

socket statistics (ss) program weird ipv6 listening socket address format

I have two services listening on TCP/IPv6 sockets, ssh and mysql. ss shows this: $ ss -tl6 State Recv-Q Send-Q Local Address:Port ...
1
vote
0answers
306 views

ss showing socket stuck in SYN-SENT with no traceable PID

On a client I see the following: [root@redacted_local ~]# ss | grep -i syn SYN-SENT 0 1 redacted_local_ip:792 redacted_server_ip:nfs ...
0
votes
2answers
39 views

What is the best and the efficient way of tracking whether Apache web server is up and running?

When I wanted to check whether the Apache web server is up and running on the linux server(CentOS), I came to two solutions by tracking through the ps command and ss command. Following I've tried: ps -...
0
votes
2answers
318 views

How can I find the mapping on `$DISPLAY` after `ssh -X`?

On machine B, I remote access machine C $ ssh -X t@C $ echo $DISPLAY localhost:10.0 How can I find/verify the mapping of $DISPLAY on C to $DISPLAY on B? Can it be done by the following command ...
0
votes
1answer
41 views

how to know what the process that connected to my machine VIA specific port

with the following command I want to get which are the IP's that connected on my machine with port 8088 18.23.292.9 is machine that resource manager service is running on with port 8088 ss -tanp | ...
0
votes
1answer
59 views

Why do nmap, ss (netscan?) and lsof give different results?

I'm trying to understand which ports are actively listening (in use?) on my machine and don't really know what I'm doing. The three commands I've experimented with are nmap, ss (?netscan?) and lsof. ...
0
votes
1answer
602 views

What does address 224.0.0.251:5353 represent?

I read some tutorials,they say that netstat is deprecated. I tried ss command. THis is the output Netid State Recv-Q Send-Q Local Address:Port ...
0
votes
1answer
156 views

Conflicting "ss" commands on OpenSuse? [duplicate]

I have OpenSuse 15.1 "Magic Leap" installed. I noticed that there seems to be two conflicting commands named ss. When I run which ss, I get this: /usr/sbin/ss And when I try to inspect, notice ...
0
votes
1answer
269 views

Networking: port listening but nc fails

I have set up a docker-compose stack on a server. One of its services is jaeger collector and is configured as follows: collector: image: jaegertracing/jaeger-collector:1.8 environment: ...
0
votes
1answer
368 views

Why does atop open a raw socket?

I install atop on Debian 9. It runs as a monitoring daemon. Why is it listening on a raw socket? Raw sockets are used to generate arbitrary IPv4 packets or capture all packets read all packets for ...
0
votes
1answer
19 views

Can I use ss and filter on PID and FD?

I'd like to be able to run ss and filter on PID=$(pgrep emacs) and FDs=(5u|6u|8u). Does ss support filtering on either (or both) of these? Or is the best option to compose with grep? I'm currently ...
0
votes
0answers
27 views

Count the number of ssh connections made from and to a solaris host per minute

The purpose of this exercise is to know the count of ssh connection that my ansible automation creates when it runs. /etc/centrifydc/ssh/sshd_config is the ssh utility that my automation uses. My ...
0
votes
0answers
24 views

Tcp connection not seen on peer node

I got several nodes to run my software. After startup, I found tcp connection is abnormal between two nodes. Assume A is the leader which is listening on port 1234, B should connect A. On node B, use ...
0
votes
0answers
11 views

conflict : watching in realtime opened ports without line wrap

How to monitor ports and connection in real time in Arch linux ? I can use watch combine with ss -tulpn, but when pipe it to less -S (to disable line wrap), the output is nothing. $sudo watch ss -...
0
votes
2answers
266 views

How can I confirm which process is connect to remote port?

My loacl server IP is 192.168.122.100, and remote server IP is 192.168.122.50. I need to kill all processes which connect to 192.168.122.50:56666. By executing ss comand, I found there are three TCP ...
0
votes
1answer
85 views

How to prevent ss ouput with empty lines?

Moving from netstat to iproute2 ss I noticed that the output from ss tends to spill over into empty "new lines" when connecting via SSH from a cygwin terminal. e.g.: user@host:~ $ ss -4t State ...
0
votes
0answers
919 views

ss command: file descriptor information when using the -p option

In ss command, when using the -p option, this presumably provides info about the process (owner, pid an fd) root@Cassiopeia:~# ss -tap | tail -1 ESTAB 0 0 [2a0i:527:9981:8511:f64e:...
-1
votes
2answers
7k views

What is "inet prefix"?

$ ss 'state = established' Error: an inet prefix is expected rather than "state". Cannot parse dst/src address. What is "inet prefix"? What is a valid "inet prefix"?
-1
votes
1answer
51 views

what are the options to close manual the port correctly or release the port on rhel machines?

we have redhat 7.5 server we are suspect that port 50070 not closed correctly by the service , ( we check by netstat and PID not found ) but from the log we can see that port is in use so we try to do ...
-2
votes
1answer
617 views

What is timer information shown by `ss -o`?

man ss says -o shows timer information. What is timer information? I can't tell it from ss -o and ss without -o. Thanks.
-5
votes
1answer
125 views

What are the differences between `-f` and `-A` of `ss`?

What are the differences between -f and -A of ss? Which of -f and -A is related to -t, -u, -4, -6, -w, -x? Does -A inet,packet imply -A tcp,udp,raw? I know a few socket concepts, but can't figure ...