Take the 2-minute tour ×

I have a linux box which is setup as firewall/gateway for the network. Was just wondering why ss and other iproute2 tools show much less than iptables conntrack. Is it because the router function is happening in kernel only?

ss -na

Shows only two established connections where as a

conntrack -L -n

Shows 18 Established connections.

share|improve this question
add comment

1 Answer

up vote 4 down vote accepted

ss and netstat show connections terminated at that host, i.e. either outgoing connections created by a process on the host, or incoming connections handled by a process on the host. (Technically these show you sockets.) conntrack shows connections known by the connection tracking system, which includes connections being routed by but not terminated by that host. (Sockets don't exist for connections only being routed.)

share|improve this answer
Makes sense - is there another tool like ss that will show things like windows sizes etc of established sockets that do not have their endpoints on the box? –  Adrian Cornish Jul 5 '12 at 1:21
@AdrianCornish Not that I know of. Routers don't deal with that information so I doubt that it is recorded. –  mgorven Jul 5 '12 at 1:36
Shame really since this router has a full blown OS on it - but I guess windows sizes, keepalives etc is really more relevant at the endpoints - would be nice to it all at the gateway though. –  Adrian Cornish Jul 5 '12 at 1:43
add comment

Your Answer


