ss - linux socket statistics utility output format

Question

When using ss with -p option, user/pid/fd column jumps underneath the particular line. For instance this is it what I'm actually seeing:

# ss -nulp4
State      Recv-Q Send-Q                                           Local Address:Port                                             Peer Address:Port 
UNCONN     0      0                                                            *:20000                                                       *:*      
users:(("perl",pid=9316,fd=6))
UNCONN     0      0                                                            *:10000                                                       *:*      
users:(("perl",pid=9277,fd=6))
UNCONN     0      0                                               192.168.100.10:53                                                          *:*      
users:(("named",pid=95,fd=517),("named",pid=95,fd=516))
UNCONN     0      0                                                    127.0.0.1:53                                                          *:*      
users:(("named",pid=95,fd=515),("named",pid=95,fd=514))

Preferred output formatting:

# ss -nulp4
State      Recv-Q Send-Q                                           Local Address:Port                                             Peer Address:Port 
UNCONN     0      0                                                            *:20000                                                       *:*      users:(("perl",pid=9316,fd=6))
UNCONN     0      0                                                            *:10000                                                       *:*      users:(("perl",pid=9277,fd=6))
UNCONN     0      0                                               192.168.100.10:53                                                          *:*      users:(("named",pid=95,fd=517),("named",pid=95,fd=516))
UNCONN     0      0                                                    127.0.0.1:53                                                          *:*      users:(("named",pid=95,fd=515),("named",pid=95,fd=514))

To confirm that there are no line breaks I've tried this:

# ss -nulp4 | cat -A
State      Recv-Q Send-Q        Local Address:Port          Peer Address:Port $
UNCONN     0      0                         *:20000                    *:*      users:(("perl",pid=9316,fd=6))$
UNCONN     0      0                         *:10000                    *:*      users:(("perl",pid=9277,fd=6))$
UNCONN     0      0            192.168.100.10:53                       *:*      users:(("named",pid=95,fd=517),("named",pid=95,fd=516))$
UNCONN     0      0                 127.0.0.1:53                       *:*      users:(("named",pid=95,fd=515),("named",pid=95,fd=514))$

And indeed you can see that there were none, but now, strangely enough, output format is the way I've wanted it to be. Could someone explain what's going on here? How can I achieve my preferred formatting?

This is the only thing stopping me from migrating from netstat to ss.

Solution 1

As for why etc.

ss, part of the iproute2 utility collection in the Linux kernel, uses an ioctl() request to get the current width of terminal.

However; the entire width is used for the «other» fields and the process field get squeezed onto next line.

You can view this by for example (when having a limited with on terminal):

script ss.txt
ss -nlup4
exit

Then widen your terminal window and cat ss.txt.

The reason why

ss -nulp4 | cat -A

«works» is because the utility recognizes if it writes to a tty or not:

if (isatty(STDOUT_FILENO)) {

}

As you can see from the prior line in the source code default width is set to 80. Thus if your terminal is at say 130 columns and you do:

ss -nulp4 | cat

it recognizes the output is not to a tty (but to a pipe) and the other fields are crammed into 80 columns, whilst the process field is written after these 80 columns. But as your terminal is wider then 80 columns and has room for the process entry it is displayed in one line.

The same goes for for example:

ss -nulp4 > ss.txt

---

As for how to «achieve my preferred formatting» one likely unsuitable way is to do something in the direction of (depending on terminal):

stty cols 100
ss -nlup4

Solution 2

Following one might be helpful to change output:

ss -ltunp | column -t 

Comments

[monsune]

Wonderful explanation and nice trick with that stty cols setting. Many thanks!

[pevik]

Nice explanation, but use column -t seems to be simplest way.

[FuePi]

The only downside of this is, that it doesn't look good with -s, --summary

[AnthonyK]

I wonder what the tools author would say to justify such useless waste of space, especially for a terminal maximized on a 4K screen!