On Sun, Jun 19, 2022 at 05:18:58PM +0000, Witold Baryluk wrote:
> $ sudo ss -lnp | awk '$5 ~ /\[::\]|0\.0\.0\.0:|\*:/ { print $0; }' | grep atop
> ??? UNCONN 0 0 0.0.0.0:255
> 0.0.0.0:* users:(("atop",pid=2185,fd=3))
> $
Interesting, that does not show up in netstat -tulpen. Please note that
ss -nlp shows an actually listening socket with a protocol:
udp UNCONN 0 0
[::]:5355 [::]:*
users:(("systemd-resolve",pid=1070,fd=13))
tcp LISTEN 0 20
127.0.0.1:587 0.0.0.0:*
users:(("exim4",pid=2123,fd=4))
While the "listening" socket reported by ss has "???" as a protocol.
According to strace, atop's fd 4 is opened to read from /sys/devices/virtual/net
Is it possible that ss is misdetecting this?
What syscalls should I be grepping for in atop's sources?
Greetings
Marc
