Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Meaning of SS command output with 3 colons (':::')?

Tags:

parsing

ss

The increasingly popular ss command (/usr/sbin/ss on RHEL) is a replacement for netstat.

I'm trying to parse the output in Python and I'm seeing some odd data that is not explained in the documentation.

$ ss -an | head
State    Recv-Q Send-Q    Local Address:Port      Peer Address:Port
LISTEN   0      0                    :::14144               :::*
LISTEN   0      0             127.0.0.1:32000                *:*
LISTEN   0      0                    :::3233                :::*
LISTEN   0      0                     *:5634                 *:*
LISTEN   0      0                    :::5634                :::*

So, it's obvious what the local address means when it's 127.0.0.1:32000, obviously listening on the loopback interface on port 32000. But, what do the 3 colons ::: mean?

Really, I can figure it's two extra colons, since the format is host:port, so what does a host of two colons mean?

I should mention I'm running this on a RHEL/CENTOS box:

Linux boxname 2.6.18-348.3.1.el5 #1 SMP somedate x86_64 x86_64 x86_64 GNU/Linux

This is not explained in any of the online man pages or other discussions I can find.

like image 849
Kevin J. Rice Avatar asked Dec 27 '13 13:12

Kevin J. Rice


People also ask

What does the SS command do?

The ss (socket statistics) tool is a CLI command used to show network statistics. The ss command is a simpler and faster version of the now obsolete netstat command. Together with the ip command, ss is essential for gathering network information and troubleshooting network issues.

When using the SS command which column shows the socket type?

The -6 command line option tells ss to display IPv6 connections only. The -f tells ss to display sockets of type FAMILY .


1 Answers

That's IPV6 abbreviated address representation. The colon groups represent consecutive zero groups.

:::14144 would be read as 0000:0000:0000:0000:0000:0000:0000:0000 port 14144 which I guess would mean all addresses with port 14144

:::* would be read as 0000:0000:0000:0000:0000:0000:0000:0000 all ports which I guess would mean all addresses with any port

like image 172
Bill Stidham Avatar answered Oct 11 '22 02:10

Bill Stidham