On Sun, 18 Oct 2026 18:19:17 +0000
Gopal Malaviya [off-list ref] wrote:
The -K/--kill option uses SOCK_DESTROY, which the kernel only provides
when built with CONFIG_INET_DIAG_DESTROY=y (default n). Closing a
socket also requires CAP_NET_ADMIN. The man page mentions neither.
Without CONFIG_INET_DIAG_DESTROY, the kernel answers every SOCK_DESTROY
request with EOPNOTSUPP. ss treats that the same as a single socket
that cannot be closed and skips it silently, so nothing is closed, no
error is printed and ss exits with status 0. For example, on a WSL2
kernel (6.6.114.1-microsoft-standard-WSL2), running as root:
# ss -tan '( sport = :52616 or dport = :52616 )'
State Recv-Q Send-Q Local Address:Port Peer Address:Port
FIN-WAIT-2 0 0 127.0.0.1:52616 127.0.0.1:58995
CLOSE-WAIT 1 0 127.0.0.1:58995 127.0.0.1:52616
# ss --kill -tan sport = :52616
State Recv-Q Send-Q Local Address:Port Peer Address:Port
# echo $?
0
# ss -tan '( sport = :52616 or dport = :52616 )'
State Recv-Q Send-Q Local Address:Port Peer Address:Port
FIN-WAIT-2 0 0 127.0.0.1:52616 127.0.0.1:58995
CLOSE-WAIT 1 0 127.0.0.1:58995 127.0.0.1:52616
With the same kernel rebuilt with CONFIG_INET_DIAG_DESTROY=y, the same
--kill command closes the matching socket when run as root, and fails
with "SOCK_DESTROY answers: Operation not permitted" without
CAP_NET_ADMIN.
Making ss report this was discussed in 2016 [1] without agreement,
since the kernel also returns EOPNOTSUPP for individual sockets that
cannot be closed (e.g. some UDP or TIME_WAIT sockets on older kernels),
and per-socket errors would be noisy on correctly configured systems.
This patch does not change behaviour; it only documents both
requirements and the silent case, so users can tell why -K had no
effect.
Link: https://lore.kernel.org/netdev/1463442791-2399-2-git-send-email-dsa@cumulusnetworks.com/ (local) [1]
Signed-off-by: Gopal Malaviya <redacted>
Nak
I would rather not turn the iproute2 man pages into a laundry list
of how commands can fail if the kernel is configured without options.
There is a huge range of kernel config options and covering all of
them would make man pages into unreadable by humans noise.
Instead, it is best to just keep the error messages. The existing error
seems clear enough that operation was not permitted.