man/man8/ss.8

   1 .TH SS 8
   2 .SH NAME
   3 ss \- another utility to investigate sockets
   4 .SH SYNOPSIS
   5 .B ss
   6 .RI [ options ] " [ FILTER ]"
   7 .SH DESCRIPTION
   8 .B ss
   9 is used to dump socket statistics. It allows showing information similar
  10 to
  11 .IR netstat .
  12 It can display more TCP and state informations than other tools.
  13
  14 .SH OPTIONS
  15 When no option is used ss displays a list of
  16 open non-listening sockets (e.g. TCP/UNIX/UDP) that have established connection.
  17 .TP
  18 .B \-h, \-\-help
  19 Show summary of options.
  20 .TP
  21 .B \-V, \-\-version
  22 Output version information.
  23 .TP
  24 .B \-H, \-\-no-header
  25 Suppress header line.
  26 .TP
  27 .B \-n, \-\-numeric
  28 Do not try to resolve service names.
  29 .TP
  30 .B \-r, \-\-resolve
  31 Try to resolve numeric address/ports.
  32 .TP
  33 .B \-a, \-\-all
  34 Display both listening and non-listening (for TCP this means established connections) sockets.
  35 .TP
  36 .B \-l, \-\-listening
  37 Display only listening sockets (these are omitted by default).
  38 .TP
  39 .B \-o, \-\-options
  40 Show timer information.
  41 .TP
  42 .B \-e, \-\-extended
  43 Show detailed socket information
  44 .TP
  45 .B \-m, \-\-memory
  46 Show socket memory usage.
  47 .TP
  48 .B \-p, \-\-processes
  49 Show process using socket.
  50 .TP
  51 .B \-i, \-\-info
  52 Show internal TCP information.
  53 .TP
  54 .B \-K, \-\-kill
  55 Attempts to forcibly close sockets. This option displays sockets that are
  56 successfully closed and silently skips sockets that the kernel does not support
  57 closing. It supports IPv4 and IPv6 sockets only.
  58 .TP
  59 .B \-s, \-\-summary
  60 Print summary statistics. This option does not parse socket lists obtaining
  61 summary from various sources. It is useful when amount of sockets is so huge
  62 that parsing /proc/net/tcp is painful.
  63 .TP
  64 .B \-Z, \-\-context
  65 As the
  66 .B \-p
  67 option but also shows process security context.
  68 .sp
  69 For
  70 .BR netlink (7)
  71 sockets the initiating process context is displayed as follows:
  72 .RS
  73 .RS
  74 .IP "1." 4
  75 If valid pid show the process context.
  76 .IP "2." 4
  77 If destination is kernel (pid = 0) show kernel initial context.
  78 .IP "3." 4
  79 If a unique identifier has been allocated by the kernel or netlink user,
  80 show context as "unavailable". This will generally indicate that a
  81 process has more than one netlink socket active.
  82 .RE
  83 .RE
  84 .TP
  85 .B \-z, \-\-contexts
  86 As the
  87 .B \-Z
  88 option but also shows the socket context. The socket context is
  89 taken from the associated inode and is not the actual socket
  90 context held by the kernel. Sockets are typically labeled with the
  91 context of the creating process, however the context shown will reflect
  92 any policy role, type and/or range transition rules applied,
  93 and is therefore a useful reference.
  94 .TP
  95 .B \-N NSNAME, \-\-net=NSNAME
  96 Switch to the specified network namespace name.
  97 .TP
  98 .B \-b, \-\-bpf
  99 Show socket BPF filters (only administrators are allowed to get these information).
 100 .TP
 101 .B \-4, \-\-ipv4
 102 Display only IP version 4 sockets (alias for -f inet).
 103 .TP
 104 .B \-6, \-\-ipv6
 105 Display only IP version 6 sockets (alias for -f inet6).
 106 .TP
 107 .B \-0, \-\-packet
 108 Display PACKET sockets (alias for -f link).
 109 .TP
 110 .B \-t, \-\-tcp
 111 Display TCP sockets.
 112 .TP
 113 .B \-u, \-\-udp
 114 Display UDP sockets.
 115 .TP
 116 .B \-d, \-\-dccp
 117 Display DCCP sockets.
 118 .TP
 119 .B \-w, \-\-raw
 120 Display RAW sockets.
 121 .TP
 122 .B \-x, \-\-unix
 123 Display Unix domain sockets (alias for -f unix).
 124 .TP
 125 .B \-S, \-\-sctp
 126 Display SCTP sockets.
 127 .TP
 128 .B \-f FAMILY, \-\-family=FAMILY
 129 Display sockets of type FAMILY.
 130 Currently the following families are supported: unix, inet, inet6, link, netlink.
 131 .TP
 132 .B \-A QUERY, \-\-query=QUERY, \-\-socket=QUERY
 133 List of socket tables to dump, separated by commas. The following identifiers
 134 are understood: all, inet, tcp, udp, raw, unix, packet, netlink, unix_dgram,
 135 unix_stream, unix_seqpacket, packet_raw, packet_dgram, dccp, sctp.
 136 .TP
 137 .B \-D FILE, \-\-diag=FILE
 138 Do not display anything, just dump raw information about TCP sockets to FILE after applying filters. If FILE is - stdout is used.
 139 .TP
 140 .B \-F FILE, \-\-filter=FILE
 141 Read filter information from FILE.
 142 Each line of FILE is interpreted like single command line option. If FILE is - stdin is used.
 143 .TP
 144 .B FILTER := [ state STATE-FILTER ] [ EXPRESSION ]
 145 Please take a look at the official documentation (Debian package iproute-doc) for details regarding filters.
 146
 147 .SH STATE-FILTER
 148
 149 .B STATE-FILTER
 150 allows to construct arbitrary set of states to match. Its syntax is sequence of keywords state and exclude followed by identifier of state.
 151 .TP
 152 Available identifiers are:
 153
 154 All standard TCP states:
 155 .BR established ", " syn-sent ", " syn-recv ", " fin-wait-1 ", " fin-wait-2 ", " time-wait ", " closed ", " close-wait ", " last-ack ", "
 156 .BR  listening " and " closing.
 157
 158 .B all
 159 - for all the states
 160
 161 .B connected
 162 - all the states except for
 163 .BR listening " and " closed
 164
 165 .B synchronized
 166 - all the
 167 .B connected
 168 states except for
 169 .B syn-sent
 170
 171 .B bucket
 172 - states, which are maintained as minisockets, i.e.
 173 .BR time-wait " and " syn-recv
 174
 175 .B big
 176 - opposite to
 177 .B bucket
 178
 179 .SH USAGE EXAMPLES
 180 .TP
 181 .B ss -t -a
 182 Display all TCP sockets.
 183 .TP
 184 .B ss -t -a -Z
 185 Display all TCP sockets with process SELinux security contexts.
 186 .TP
 187 .B ss -u -a
 188 Display all UDP sockets.
 189 .TP
 190 .B ss -o state established '( dport = :ssh or sport = :ssh )'
 191 Display all established ssh connections.
 192 .TP
 193 .B ss -x src /tmp/.X11-unix/*
 194 Find all local processes connected to X server.
 195 .TP
 196 .B ss -o state fin-wait-1 '( sport = :http or sport = :https )' dst 193.233.7/24
 197 List all the tcp sockets in state FIN-WAIT-1 for our apache to network 193.233.7/24 and look at their timers.
 198 .SH SEE ALSO
 199 .BR ip (8),
 200 .BR /usr/share/doc/iproute-doc/ss.html " (package iproutedoc)",
 201 .br
 202 .BR RFC " 793 "
 203 - https://tools.ietf.org/rfc/rfc793.txt (TCP states)
 204
 205 .SH AUTHOR
 206 .I ss
 207 was written by Alexey Kuznetsov, <kuznet@ms2.inr.ac.ru>.
 208 .PP
 209 This manual page was written by Michael Prokop <mika@grml.org>
 210 for the Debian project (but may be used by others).