man/man8/ss.8

   1 .TH SS 8
   2 .SH NAME
   3 ss \- another utility to investigate sockets
   4 .SH SYNOPSIS
   5 .B ss
   6 .RI [ options ] " [ FILTER ]"
   7 .SH DESCRIPTION
   8 .B ss
   9 is used to dump socket statistics. It allows showing information similar
  10 to
  11 .IR netstat .
  12 It can display more TCP and state informations than other tools.
  13
  14 .SH OPTIONS
  15 When no option is used ss displays a list of
  16 open non-listening sockets (e.g. TCP/UNIX/UDP) that have established connection.
  17 .TP
  18 .B \-h, \-\-help
  19 Show summary of options.
  20 .TP
  21 .B \-V, \-\-version
  22 Output version information.
  23 .TP
  24 .B \-H, \-\-no-header
  25 Suppress header line.
  26 .TP
  27 .B \-n, \-\-numeric
  28 Do not try to resolve service names.
  29 .TP
  30 .B \-r, \-\-resolve
  31 Try to resolve numeric address/ports.
  32 .TP
  33 .B \-a, \-\-all
  34 Display both listening and non-listening (for TCP this means established connections) sockets.
  35 .TP
  36 .B \-l, \-\-listening
  37 Display only listening sockets (these are omitted by default).
  38 .TP
  39 .B \-o, \-\-options
  40 Show timer information.
  41 .TP
  42 .B \-e, \-\-extended
  43 Show detailed socket information
  44 .TP
  45 .B \-m, \-\-memory
  46 Show socket memory usage.
  47 .TP
  48 .B \-p, \-\-processes
  49 Show process using socket.
  50 .TP
  51 .B \-i, \-\-info
  52 Show internal TCP information.
  53 .TP
  54 .B \-K, \-\-kill
  55 Attempts to forcibly close sockets. This option displays sockets that are
  56 successfully closed and silently skips sockets that the kernel does not support
  57 closing. It supports IPv4 and IPv6 sockets only.
  58 .TP
  59 .B \-s, \-\-summary
  60 Print summary statistics. This option does not parse socket lists obtaining
  61 summary from various sources. It is useful when amount of sockets is so huge
  62 that parsing /proc/net/tcp is painful.
  63 .TP
  64 .B \-Z, \-\-context
  65 As the
  66 .B \-p
  67 option but also shows process security context.
  68 .sp
  69 For
  70 .BR netlink (7)
  71 sockets the initiating process context is displayed as follows:
  72 .RS
  73 .RS
  74 .IP "1." 4
  75 If valid pid show the process context.
  76 .IP "2." 4
  77 If destination is kernel (pid = 0) show kernel initial context.
  78 .IP "3." 4
  79 If a unique identifier has been allocated by the kernel or netlink user,
  80 show context as "unavailable". This will generally indicate that a
  81 process has more than one netlink socket active.
  82 .RE
  83 .RE
  84 .TP
  85 .B \-z, \-\-contexts
  86 As the
  87 .B \-Z
  88 option but also shows the socket context. The socket context is
  89 taken from the associated inode and is not the actual socket
  90 context held by the kernel. Sockets are typically labeled with the
  91 context of the creating process, however the context shown will reflect
  92 any policy role, type and/or range transition rules applied,
  93 and is therefore a useful reference.
  94 .TP
  95 .B \-N NSNAME, \-\-net=NSNAME
  96 Switch to the specified network namespace name.
  97 .TP
  98 .B \-b, \-\-bpf
  99 Show socket BPF filters (only administrators are allowed to get these information).
 100 .TP
 101 .B \-4, \-\-ipv4
 102 Display only IP version 4 sockets (alias for -f inet).
 103 .TP
 104 .B \-6, \-\-ipv6
 105 Display only IP version 6 sockets (alias for -f inet6).
 106 .TP
 107 .B \-0, \-\-packet
 108 Display PACKET sockets (alias for -f link).
 109 .TP
 110 .B \-t, \-\-tcp
 111 Display TCP sockets.
 112 .TP
 113 .B \-u, \-\-udp
 114 Display UDP sockets.
 115 .TP
 116 .B \-d, \-\-dccp
 117 Display DCCP sockets.
 118 .TP
 119 .B \-w, \-\-raw
 120 Display RAW sockets.
 121 .TP
 122 .B \-x, \-\-unix
 123 Display Unix domain sockets (alias for -f unix).
 124 .TP
 125 .B \-S, \-\-sctp
 126 Display SCTP sockets.
 127 .TP
 128 .B \-\-vsock
 129 Display vsock sockets (alias for -f vsock).
 130 .TP
 131 .B \-f FAMILY, \-\-family=FAMILY
 132 Display sockets of type FAMILY.
 133 Currently the following families are supported: unix, inet, inet6, link, netlink, vsock.
 134 .TP
 135 .B \-A QUERY, \-\-query=QUERY, \-\-socket=QUERY
 136 List of socket tables to dump, separated by commas. The following identifiers
 137 are understood: all, inet, tcp, udp, raw, unix, packet, netlink, unix_dgram,
 138 unix_stream, unix_seqpacket, packet_raw, packet_dgram, dccp, sctp,
 139 vsock_stream, vsock_dgram.
 140 .TP
 141 .B \-D FILE, \-\-diag=FILE
 142 Do not display anything, just dump raw information about TCP sockets to FILE after applying filters. If FILE is - stdout is used.
 143 .TP
 144 .B \-F FILE, \-\-filter=FILE
 145 Read filter information from FILE.
 146 Each line of FILE is interpreted like single command line option. If FILE is - stdin is used.
 147 .TP
 148 .B FILTER := [ state STATE-FILTER ] [ EXPRESSION ]
 149 Please take a look at the official documentation (Debian package iproute-doc) for details regarding filters.
 150
 151 .SH STATE-FILTER
 152
 153 .B STATE-FILTER
 154 allows to construct arbitrary set of states to match. Its syntax is sequence of keywords state and exclude followed by identifier of state.
 155 .TP
 156 Available identifiers are:
 157
 158 All standard TCP states:
 159 .BR established ", " syn-sent ", " syn-recv ", " fin-wait-1 ", " fin-wait-2 ", " time-wait ", " closed ", " close-wait ", " last-ack ", "
 160 .BR  listening " and " closing.
 161
 162 .B all
 163 - for all the states
 164
 165 .B connected
 166 - all the states except for
 167 .BR listening " and " closed
 168
 169 .B synchronized
 170 - all the
 171 .B connected
 172 states except for
 173 .B syn-sent
 174
 175 .B bucket
 176 - states, which are maintained as minisockets, i.e.
 177 .BR time-wait " and " syn-recv
 178
 179 .B big
 180 - opposite to
 181 .B bucket
 182
 183 .SH USAGE EXAMPLES
 184 .TP
 185 .B ss -t -a
 186 Display all TCP sockets.
 187 .TP
 188 .B ss -t -a -Z
 189 Display all TCP sockets with process SELinux security contexts.
 190 .TP
 191 .B ss -u -a
 192 Display all UDP sockets.
 193 .TP
 194 .B ss -o state established '( dport = :ssh or sport = :ssh )'
 195 Display all established ssh connections.
 196 .TP
 197 .B ss -x src /tmp/.X11-unix/*
 198 Find all local processes connected to X server.
 199 .TP
 200 .B ss -o state fin-wait-1 '( sport = :http or sport = :https )' dst 193.233.7/24
 201 List all the tcp sockets in state FIN-WAIT-1 for our apache to network 193.233.7/24 and look at their timers.
 202 .SH SEE ALSO
 203 .BR ip (8),
 204 .BR /usr/share/doc/iproute-doc/ss.html " (package iproutedoc)",
 205 .br
 206 .BR RFC " 793 "
 207 - https://tools.ietf.org/rfc/rfc793.txt (TCP states)
 208
 209 .SH AUTHOR
 210 .I ss
 211 was written by Alexey Kuznetsov, <kuznet@ms2.inr.ac.ru>.
 212 .PP
 213 This manual page was written by Michael Prokop <mika@grml.org>
 214 for the Debian project (but may be used by others).