ss: stdout differs from oracle for ss <supported socket listing flags>

[matt-dz]

Summary

rshell and the oracle produced different results for ss <supported socket listing flags>.

Command

ss -ltn

Reduced command shape: ss <supported socket listing flags>

Expected (oracle)

Exit code: 0

stdout:

State  Recv-Q Send-Q Local Address:Port  Peer Address:PortProcess
LISTEN 0      4096       127.0.0.1:2381       0.0.0.0:*          
LISTEN 0      4096       127.0.0.1:2379       0.0.0.0:*          
LISTEN 0      4096       127.0.0.1:10257      0.0.0.0:*          
LISTEN 0      4096       127.0.0.1:10259      0.0.0.0:*          
LISTEN 0      4096       127.0.0.1:10249      0.0.0.0:*          
LISTEN 0      4096       127.0.0.1:10248      0.0.0.0:*          
LISTEN 0      4096      127.0.0.11:42505      0.0.0.0:*          
LISTEN 0      4096      172.18.0.2:2379       0.0.0.0:*          
LISTEN 0      4096      172.18.0.2:2380       0.0.0.0:*          
LISTEN 0      4096       127.0.0.1:37909      0.0.0.0:*          
LISTEN 0      4096               *:10256            *:*          
LISTEN 0      4096               *:10250            *:*          
LISTEN 0      4096               *:6443             *:*          

stderr:

(empty)

Actual (rshell)

Exit code: 0

stdout:

Netid  State       Recv-Q  Send-Q  Local Address:Port           Peer Address:Port           
tcp    LISTEN           0       0  127.0.0.1:2381               0.0.0.0:*                   
tcp    LISTEN           0       0  127.0.0.1:2379               0.0.0.0:*                   
tcp    LISTEN           0       0  127.0.0.1:10257              0.0.0.0:*                   
tcp    LISTEN           0       0  127.0.0.1:10259              0.0.0.0:*                   
tcp    LISTEN           0       0  127.0.0.1:10249              0.0.0.0:*                   
tcp    LISTEN           0       0  127.0.0.1:10248              0.0.0.0:*                   
tcp    LISTEN           0       0  127.0.0.11:42505             0.0.0.0:*                   
tcp    LISTEN           0       0  172.18.0.2:2379              0.0.0.0:*                   
tcp    LISTEN           0       0  172.18.0.2:2380              0.0.0.0:*                   
tcp    LISTEN           0       0  127.0.0.1:37909              0.0.0.0:*                   
tcp    LISTEN           0       0  :::10256                     :::*                        
tcp    LISTEN           0       0  :::10250
... <truncated>

stderr:

(empty)

Why This Matters

The QA run observed this command shape in 157 invocations across 49 scenarios.

Additional Observed Command Shapes

• printf "2379 states:\n" ; ss -tan | grep ":2379" | tr -s " " | cut -d " " -f 2 | sort | uniq -c ; printf "6443 states:\n" ; ss -tan | grep ":6443" | tr -s " " | cut -d " " -f 2 | sort | uniq -c ; printf "sample 6443 sockets:\n" ; ss -tan | grep ":6443" | head -n 30
• ss -ant
• ss -ant | cut -d " " -f 1 | sort | uniq -c
• ss -ant | grep "10.244.0.7:9092" | cut -d " " -f 1 | sort | uniq -c
• ss -ant | grep "10.244.0.7:9092" | head -20
• ss -ant | grep "10.244.0.7:9092" | tr -s " " | cut -d " " -f 2 | sort | uniq -c
• ss -ant | grep "10.244.0.8:9200" | cut -d " " -f 1 | sort | uniq -c
• ss -ant | grep "10.244.0.8:9200" | head -20
• ss -ant | grep "10.244.0.8:9200" | tr -s " " | cut -d " " -f 2 | sort | uniq -c
• ss -ant | grep "9092\|9093\|8080" | head -80
• ss -ant | grep ":9092" | sort | uniq -c
• ss -ant | grep -E ":(9200|9300|9092|9093)" | head -80
• ss -antH
• ss -antH | grep -E "10.96.106.196:9092|10.244.0.17:9092|:6379|:8080" | head -120
• ss -lnt
• ss -lnt | head -80
• ss -lnt | head -n 20
• ss -lntH
• ss -ltn
• ss -ltn | grep -E "9092|29092|2181|8080|9200|9300|443"
• ss -ltn | grep -E ":(53|8080|9092|9093|10250|10257|10259)"
• ss -ltn | head -80
• ss -ltn | head -n 80
• ss -ltn | sort | head -120
• ss -ltnH | sort
• ss -ltnH | sort | head -n 80
• ss -ltnp 2>/dev/null | head -n 80
• ss -t -n -a | grep -E ":9092|:9200|:9300"
• ss -tan
• ss -tan -o
• ss -tan state established | grep "10.244.0.10:9092\|10.244.0.13:9200"
• ss -tan | cut -d " " -f 1 | sort | uniq -c
• ss -tan | grep "10.244.0.17:9092\|:8080\|:8181\|:443\|:80" | sort | uniq -c
• ss -tan | grep "10.244.0.21:9092" | tr -s " " | cut -d " " -f 2 | sort | uniq -c
• ss -tan | grep "10.244.0.24:9092"
• ss -tan | grep "10.244.0.2:8080"
• ss -tan | grep "10.244.0.36\|10.244.0.37\|10.96.15.111" | head -120
• ss -tan | grep "10.244.0.37:9092" | head -60
• ss -tan | grep "10.244.0.54:9092" | cut -c 1-80 | sort | uniq -c
• ss -tan | grep "10.244.0.82:5432" | head -50
• ss -tan | grep "9092\|9200\|9300" | head -n 80
• ss -tan | grep ":5432" | head -80
• ss -tan | grep ":8080" | head -80
• ss -tan | grep ":909" | head -n 120
• ss -tan | grep ":909" | tr -s " " | cut -d " " -f 2,5,6 | sort | uniq -c
• ss -tan | grep ":9092"
• ss -tan | grep ":9092" | cut -d " " -f 1,2,3,4,5,6,7,8 | sort | uniq -c
• ss -tan | grep ":9092" | head -n 80
• ss -tan | grep ":9092" | sed "s/ */ /g" | cut -d " " -f 1 | sort | uniq -c
• ss -tan | grep ":9092" | tr -s " " | cut -d " " -f 2 | sort | uniq -c
• ss -tan | grep ":9092\|:53\|:8126\|:8125" | head -120
• ss -tan | grep ":9092\|:8080" | head -120
• ss -tan | grep ":9200" | cut -d " " -f 1 | sort | uniq -c
• ss -tan | grep ":9200" | sort | uniq -c
• ss -tan | grep ":9200\|:8080" | head -n 120
• ss -tan | grep "ESTAB" | head -n 120
• ss -tan | grep "TIME-WAIT" | head -n 120
• ss -tan | grep -E "(:9092|:6379|:8080|:3000|:5000|:8000)" | head -80
• ss -tan | grep -E "(:9092|:9095|:29092|:8474|10.244.0.5|10.244.0.6)"
• ss -tan | grep -E "10.244.0.(26|27|28|29)|:9092|:6379|:50051" | head -120
• ss -tan | grep -E "10.244.0.5|10.244.0.6|:9092|:9095|:29092|:8474" | sort
• ss -tan | grep -E "10\.244\.0\.(17|18|22)|10\.96\.(253|205)" | head -120
• ss -tan | grep -E "10\.244\.0\.(2|3)|10\.96\.0\.10|:53|:8080|:8181" | head -120
• ss -tan | grep -E "10\.244\.0\.(54|56|2|4):(9092|8080|8181)|State|LISTEN" | head -200
• ss -tan | grep -E "10\.244\.0\.[0-9]+:(8080|9092|8126)"
• ss -tan | grep -E "10\.244\.|:8080|:80|:443|:9092" | head -80
• ss -tan | grep -E "10\.96\.67\.228|10\.96\.|10\.244\.0\.(5|6)|:8080|:9092|:8126" | head -120
• ss -tan | grep -E "8126|9200|8080|:389|:1389|:1099|SYN|CLOSE|TIME-WAIT" | head -120
• ss -tan | grep -E "9092|29092|2181|8080|9200|9300|443"
• ss -tan | grep -E "9092|8080" | head -80
• ss -tan | grep -E ":(8080|8126|8125)" | head -n 50
• ss -tan | grep -E ":8080|10.96|api"
• ss -tan | grep -E ":8080|:8081|:27017|:8126" | head -80
• ss -tan | grep -E ":80|:8080|:8404|:9999" | head -100
• ss -tan | grep -E ":9092|:9093|:10250|:6443" | head -80
• ss -tan | grep 10.244.0.69 | head -n 30
• ss -tan | grep 9092
• ss -tan | grep ESTAB | head -n 30
• ss -tan | grep ESTAB | sort | head -n 120
• ss -tan | head -120
• ss -tan | head -60
• ss -tan | head -80
• ss -tan | head -n 160
• ss -tan | head -n 80
• ss -tan | sed "s/ */ /g" | cut -d " " -f 1 | sort | uniq -c
• ss -tan | tr -s " " | cut -d " " -f 2 | sort | uniq -c
• ss -tan | tr -s " " | cut -d " " -f 2,6 | sort | uniq -c | grep "10.244.0.33\|10.244.0.35\|10.244.0.36"
• ss -tanH | cut -d " " -f 1 | sort | uniq -c
• ss -tanH | grep "10.244.0" | head -120
• ss -tanH | grep "10.244.0.4" | wc -l
• ss -tanH | grep "10.244.0.77:9092\|10.96.59.83:9092" | sort
• ss -tanH | grep "10.244.0.89:9092" | sed "s/ */ /g" | cut -d " " -f 2 | sort | uniq -c
• ss -tanH | grep ":9092" | sed "s/ */ /g" | cut -d " " -f 2 | sort | uniq -c
• ss -tanH | grep ":9092" | sort | uniq -c
• ss -tanH | grep ":9092" | tr -s " " | cut -d " " -f 1,5 | sort | uniq -c
• ss -tanH | grep ":9092" | tr -s " " | cut -d " " -f 1,5,6 | sort | head -80
• ss -tanH | grep ":9200" | head -20
• ss -tanH | grep ":9200" | head -80
• ss -tanH | grep ":9200" | tail -40
• ss -tanH | grep ":9200" | tr -s " " | cut -d " " -f 2 | sort | uniq -c
• ss -tanH | grep ":9200" | tr -s " " | cut -d " " -f 6 | sort | uniq -c
• ss -tanH | grep -E "10\.244\.0\.|:8080|8126" | head -120
• ss -tanH | grep -E ":8080|:53|10\.96\.|10\.244\." | head -n 80
• ss -tanH | grep -E ":9092|10.244.0.89" | head -80
• ss -tanH | grep -E "SYN|ESTAB|TIME-WAIT|8126" | head -120
• ss -tanH | grep ESTAB | head -n 40
• ss -tanH | head -80
• ss -tanH | sed "s/ */ /g" | cut -d " " -f 2 | sort | uniq -c
• ss -tanH | tr -s " " | cut -d " " -f 5 | sort | uniq -c | sort | tail -40
• ss -tanH | tr -s " " | cut -d " " -f 6 | grep -E ":(8080|9092)$" | sort | uniq -c | sort
• ss -tanHe | grep "10.244.0.77:9092\|10.96.59.83:9092" | head -n 40
• ss -tanl | grep ":9092\|:9093\|:9094"
• ss -tanl | head -80
• ss -tanp 2>/dev/null | head -80
• ss -tln
• ss -tln | head -120
• ss -tn | grep "10.244.0.12:9092" | wc -l
• ss -tn | grep "10.244.0.24:9092" | head -40
• ss -tn | grep -E "9092|27017|8080|:80" | head -80
• ss -tn | grep -E ":(53|8080|9092|9093)" | head -80
• ss -tuln

QA provenance

• QA run id: run-20260602t141945z-ss
• Target builtin: ss
• Rshell commit/version: unknown
• Example invocation: inv-20260602T143111.255643062Z-b3ce297d
• Observed invocations: 157
• Scenario count: 49
• Differing dimension: stdout