Meaning of SS command output with 3 colons (':::')?

2.7k views Asked by At

The increasingly popular ss command (/usr/sbin/ss on RHEL) is a replacement for netstat.

I'm trying to parse the output in Python and I'm seeing some odd data that is not explained in the documentation.

$ ss -an | head
State    Recv-Q Send-Q    Local Address:Port      Peer Address:Port
LISTEN   0      0                    :::14144               :::*
LISTEN   0      0             127.0.0.1:32000                *:*
LISTEN   0      0                    :::3233                :::*
LISTEN   0      0                     *:5634                 *:*
LISTEN   0      0                    :::5634                :::*

So, it's obvious what the local address means when it's 127.0.0.1:32000, obviously listening on the loopback interface on port 32000. But, what do the 3 colons ::: mean?

Really, I can figure it's two extra colons, since the format is host:port, so what does a host of two colons mean?

I should mention I'm running this on a RHEL/CENTOS box:

Linux boxname 2.6.18-348.3.1.el5 #1 SMP somedate x86_64 x86_64 x86_64 GNU/Linux

This is not explained in any of the online man pages or other discussions I can find.

1

There are 1 answers

0
Bill Stidham On BEST ANSWER

That's IPV6 abbreviated address representation. The colon groups represent consecutive zero groups.

:::14144 would be read as 0000:0000:0000:0000:0000:0000:0000:0000 port 14144 which I guess would mean all addresses with port 14144

:::* would be read as 0000:0000:0000:0000:0000:0000:0000:0000 all ports which I guess would mean all addresses with any port