Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a linux box which is setup as firewall/gateway for the network. Was just wondering why ss and other iproute2 tools show much less than iptables conntrack. Is it because the router function is happening in kernel only?

ss -na

Shows only two established connections where as a

conntrack -L -n

Shows 18 Established connections.

share|improve this question
up vote 4 down vote accepted

ss and netstat show connections terminated at that host, i.e. either outgoing connections created by a process on the host, or incoming connections handled by a process on the host. (Technically these show you sockets.) conntrack shows connections known by the connection tracking system, which includes connections being routed by but not terminated by that host. (Sockets don't exist for connections only being routed.)

share|improve this answer
Makes sense - is there another tool like ss that will show things like windows sizes etc of established sockets that do not have their endpoints on the box? – Adrian Cornish Jul 5 '12 at 1:21
@AdrianCornish Not that I know of. Routers don't deal with that information so I doubt that it is recorded. – mgorven Jul 5 '12 at 1:36
Shame really since this router has a full blown OS on it - but I guess windows sizes, keepalives etc is really more relevant at the endpoints - would be nice to it all at the gateway though. – Adrian Cornish Jul 5 '12 at 1:43

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.