man/man8/ss.8

   1 .TH SS 8
   2 .SH NAME
   3 ss \- another utility to investigate sockets
   4 .SH SYNOPSIS
   5 .B ss
   6 .RI [ options ] " [ FILTER ]"
   7 .SH DESCRIPTION
   8 .B ss
   9 is used to dump socket statistics. It allows showing information similar
  10 to
  11 .IR netstat .
  12 It can display more TCP and state informations than other tools.
  13
  14 .SH OPTIONS
  15 When no option is used ss displays a list of
  16 open non-listening TCP sockets that have established connection.
  17 .TP
  18 .B \-h, \-\-help
  19 Show summary of options.
  20 .TP
  21 .B \-V, \-\-version
  22 Output version information.
  23 .TP
  24 .B \-n, \-\-numeric
  25 Do not try to resolve service names.
  26 .TP
  27 .B \-r, \-\-resolve
  28 Try to resolve numeric address/ports.
  29 .TP
  30 .B \-a, \-\-all
  31 Display both listening and non-listening (for TCP this means established connections) sockets.
  32 .TP
  33 .B \-l, \-\-listening
  34 Display only listening sockets (these are omitted by default).
  35 .TP
  36 .B \-o, \-\-options
  37 Show timer information.
  38 .TP
  39 .B \-e, \-\-extended
  40 Show detailed socket information
  41 .TP
  42 .B \-m, \-\-memory
  43 Show socket memory usage.
  44 .TP
  45 .B \-p, \-\-processes
  46 Show process using socket.
  47 .TP
  48 .B \-i, \-\-info
  49 Show internal TCP information.
  50 .TP
  51 .B \-s, \-\-summary
  52 Print summary statistics. This option does not parse socket lists obtaining
  53 summary from various sources. It is useful when amount of sockets is so huge
  54 that parsing /proc/net/tcp is painful.
  55 .TP
  56 .B \-Z, \-\-context
  57 As the
  58 .B \-p
  59 option but also shows process security context.
  60 .sp
  61 For
  62 .BR netlink (7)
  63 sockets the initiating process context is displayed as follows:
  64 .RS
  65 .RS
  66 .IP "1." 4
  67 If valid pid show the process context.
  68 .IP "2." 4
  69 If destination is kernel (pid = 0) show kernel initial context.
  70 .IP "3." 4
  71 If a unique identifier has been allocated by the kernel or netlink user,
  72 show context as "unavailable". This will generally indicate that a
  73 process has more than one netlink socket active.
  74 .RE
  75 .RE
  76 .TP
  77 .B \-z, \-\-contexts
  78 As the
  79 .B \-Z
  80 option but also shows the socket context. The socket context is
  81 taken from the associated inode and is not the actual socket
  82 context held by the kernel. Sockets are typically labeled with the
  83 context of the creating process, however the context shown will reflect
  84 any policy role, type and/or range transition rules applied,
  85 and is therefore a useful reference.
  86 .TP
  87 .B \-N NSNAME, \-\-net=NSNAME
  88 Switch to the specified network namespace name.
  89 .TP
  90 .B \-b, \-\-bpf
  91 Show socket BPF filters (only administrators are allowed to get these information).
  92 .TP
  93 .B \-4, \-\-ipv4
  94 Display only IP version 4 sockets (alias for -f inet).
  95 .TP
  96 .B \-6, \-\-ipv6
  97 Display only IP version 6 sockets (alias for -f inet6).
  98 .TP
  99 .B \-0, \-\-packet
 100 Display PACKET sockets (alias for -f link).
 101 .TP
 102 .B \-t, \-\-tcp
 103 Display TCP sockets.
 104 .TP
 105 .B \-u, \-\-udp
 106 Display UDP sockets.
 107 .TP
 108 .B \-d, \-\-dccp
 109 Display DCCP sockets.
 110 .TP
 111 .B \-w, \-\-raw
 112 Display RAW sockets.
 113 .TP
 114 .B \-x, \-\-unix
 115 Display Unix domain sockets (alias for -f unix).
 116 .TP
 117 .B \-f FAMILY, \-\-family=FAMILY
 118 Display sockets of type FAMILY.
 119 Currently the following families are supported: unix, inet, inet6, link, netlink.
 120 .TP
 121 .B \-A QUERY, \-\-query=QUERY, \-\-socket=QUERY
 122 List of socket tables to dump, separated by commas. The following identifiers
 123 are understood: all, inet, tcp, udp, raw, unix, packet, netlink, unix_dgram,
 124 unix_stream, unix_seqpacket, packet_raw, packet_dgram.
 125 .TP
 126 .B \-D FILE, \-\-diag=FILE
 127 Do not display anything, just dump raw information about TCP sockets to FILE after applying filters. If FILE is - stdout is used.
 128 .TP
 129 .B \-F FILE, \-\-filter=FILE
 130 Read filter information from FILE.
 131 Each line of FILE is interpreted like single command line option. If FILE is - stdin is used.
 132 .TP
 133 .B FILTER := [ state STATE-FILTER ] [ EXPRESSION ]
 134 Please take a look at the official documentation (Debian package iproute-doc) for details regarding filters.
 135
 136 .SH STATE-FILTER
 137
 138 .B STATE-FILTER
 139 allows to construct arbitrary set of states to match. Its syntax is sequence of keywords state and exclude followed by identifier of state.
 140 .TP
 141 Available identifiers are:
 142
 143 All standard TCP states:
 144 .BR established ", " syn-sent ", " syn-recv ", " fin-wait-1 ", " fin-wait-2 ", " time-wait ", " closed ", " close-wait ", " last-ack ", "
 145 .BR  listen " and " closing.
 146
 147 .B all
 148 - for all the states
 149
 150 .B connected
 151 - all the states except for
 152 .BR listen " and " closed
 153
 154 .B synchronized
 155 - all the
 156 .B connected
 157 states except for
 158 .B syn-sent
 159
 160 .B bucket
 161 - states, which are maintained as minisockets, i.e.
 162 .BR time-wait " and " syn-recv
 163
 164 .B big
 165 - opposite to
 166 .B bucket
 167
 168 .SH USAGE EXAMPLES
 169 .TP
 170 .B ss -t -a
 171 Display all TCP sockets.
 172 .TP
 173 .B ss -t -a -Z
 174 Display all TCP sockets with process SELinux security contexts.
 175 .TP
 176 .B ss -u -a
 177 Display all UDP sockets.
 178 .TP
 179 .B ss -o state established '( dport = :ssh or sport = :ssh )'
 180 Display all established ssh connections.
 181 .TP
 182 .B ss -x src /tmp/.X11-unix/*
 183 Find all local processes connected to X server.
 184 .TP
 185 .B ss -o state fin-wait-1 '( sport = :http or sport = :https )' dst 193.233.7/24
 186 List all the tcp sockets in state FIN-WAIT-1 for our apache to network 193.233.7/24 and look at their timers.
 187 .SH SEE ALSO
 188 .BR ip (8),
 189 .BR /usr/share/doc/iproute-doc/ss.html " (package iproutedoc)",
 190 .br
 191 .BR RFC " 793 "
 192 - https://tools.ietf.org/rfc/rfc793.txt (TCP states)
 193
 194 .SH AUTHOR
 195 .I ss
 196 was written by Alexey Kuznetsov, <kuznet@ms2.inr.ac.ru>.
 197 .PP
 198 This manual page was written by Michael Prokop <mika@grml.org>
 199 for the Debian project (but may be used by others).