0

We use an alias for getting information how many established connections are for sshd process name. Recently we updated all our packages. Even we have lots of connections to sshd server, they are not reported by process name in netstat. Process name appears as a figure, the first one is 0 and increments by 1.

Netstat - Missing sshd process name from result

I am using netstat command then grepping by process name then by port as root. Listen ports shows correctly PID/process name, but for Established connections it shows PID/number. Process name is missing for established connection.

ADDISON74
  • 101

1 Answers1

0

You could also use

lsof -i:22

to list the active ssh sessions and daemons running.

Thomas
  • 6,223
  • Yes I know. But I would like to understand if this is a netstat issue or sshd. Something happened between updates. – ADDISON74 Jan 10 '16 at 12:32
  • hm...this looks like a bug in netstat. I quickly have copied the netstat from a fedora22 machine where the process name is shown. And using the netstat from fedora22 does show the process name under Ubuntu 14.04. – Thomas Jan 10 '16 at 14:55
  • I agree this is a bug in netstat related only to established sshd connections. netstat replaces sshd process name with a number from 0 to how many established connections you have. A few moments ago I finished installing in a Virtual Machine both Debian 7.9 and 8.2. This issue is present. If Debian is affected all its flavors like Ubuntu are affected too. Debian maintenance team must be informed. – ADDISON74 Jan 10 '16 at 16:45
  • hm...on my installation ( Ubuntu 14.04 ) the second number seems to be the pts number of SSH_TTY. Normally the content of /proc/<pid>/cmdline should be appended in netstat, after the PID itself. – Thomas Jan 10 '16 at 16:49
  • It could be related to PuTTY. My connections using WinSCP (Windows 7) to Ubuntu Server looks like this:

    tcp 0 0 192.168.159.102:22 192.168.159.1:50275 ESTABLISHED 4383/sshd: root@not tcp 0 64 192.168.159.102:22 192.168.159.1:50308 ESTABLISHED 4471/0

    As you can see both are established, the one from WinSCP shows correctly the process name. The other one from PuTTY shows only 0.

     – ADDISON74 Jan 10 '16 at 18:40
  • It's not related to PuTTY. I established a connection from Terminal in CentOS. It appears same: 4471/1. This is a bug in netstat. And it comes from Debian. – ADDISON74 Jan 10 '16 at 18:45