On Sun, Jun 19, 2022 at 05:18:58PM +0000, Witold Baryluk wrote: > $ sudo ss -lnp | awk '$5 ~ /\[::\]|0\.0\.0\.0:|\*:/ { print $0; }' | grep atop > ??? UNCONN 0 0 0.0.0.0:255 > 0.0.0.0:* users:(("atop",pid=2185,fd=3)) > $
Interesting, that does not show up in netstat -tulpen. Please note that ss -nlp shows an actually listening socket with a protocol: udp UNCONN 0 0 [::]:5355 [::]:* users:(("systemd-resolve",pid=1070,fd=13)) tcp LISTEN 0 20 127.0.0.1:587 0.0.0.0:* users:(("exim4",pid=2123,fd=4)) While the "listening" socket reported by ss has "???" as a protocol. According to strace, atop's fd 4 is opened to read from /sys/devices/virtual/net Is it possible that ss is misdetecting this? What syscalls should I be grepping for in atop's sources? Greetings Marc