← Notes

Reading the accept queue with ss

Recv-Q on a listening socket counts connections that finished the handshake but the application has not accepted yet. When it equals Send-Q the accept queue is full and the kernel still answers SYN, so a port check passes while the service never replies.

ss -lnt 'sport = :443'
netstat -s | grep -i 'listen queue'