]>
Commit | Line | Data |
---|---|---|
d7eeca84 SH |
1 | .TH SS 8 |
2 | .SH NAME | |
3 | ss \- another utility to investigate sockets | |
4 | .SH SYNOPSIS | |
5 | .B ss | |
6 | .RI [ options ] " [ FILTER ]" | |
7 | .SH DESCRIPTION | |
8 | .B ss | |
9 | is used to dump socket statistics. It allows showing information similar | |
10 | to | |
11 | .IR netstat . | |
f76ad635 | 12 | It can display more TCP and state information than other tools. |
d7eeca84 SH |
13 | |
14 | .SH OPTIONS | |
f76ad635 SH |
15 | When no option is used ss displays a list of open non-listening |
16 | sockets (e.g. TCP/UNIX/UDP) that have established connection. | |
d7eeca84 SH |
17 | .TP |
18 | .B \-h, \-\-help | |
19 | Show summary of options. | |
20 | .TP | |
21 | .B \-V, \-\-version | |
22 | Output version information. | |
23 | .TP | |
7a4559f6 DA |
24 | .B \-H, \-\-no-header |
25 | Suppress header line. | |
26 | .TP | |
296b5de7 JH |
27 | .B \-O, \-\-oneline |
28 | Print each socket's data on a single line. | |
29 | .TP | |
d7eeca84 | 30 | .B \-n, \-\-numeric |
d98e300c | 31 | Do not try to resolve service names. |
d7eeca84 SH |
32 | .TP |
33 | .B \-r, \-\-resolve | |
34 | Try to resolve numeric address/ports. | |
35 | .TP | |
36 | .B \-a, \-\-all | |
f76ad635 SH |
37 | Display both listening and non-listening (for TCP this means |
38 | established connections) sockets. | |
d7eeca84 SH |
39 | .TP |
40 | .B \-l, \-\-listening | |
5d805635 | 41 | Display only listening sockets (these are omitted by default). |
d7eeca84 SH |
42 | .TP |
43 | .B \-o, \-\-options | |
f76ad635 | 44 | Show timer information. For TCP protocol, the output format is: |
5a9bca71 | 45 | .RS |
46 | .P | |
47 | timer:(<timer_name>,<expire_time>,<retrans>) | |
48 | .P | |
49 | .TP | |
50 | .B <timer_name> | |
51 | the name of the timer, there are five kind of timer names: | |
52 | .RS | |
53 | .P | |
f76ad635 SH |
54 | .B on |
55 | : means one of these timers: TCP retrans timer, TCP early retrans | |
56 | timer and tail loss probe timer | |
5a9bca71 | 57 | .P |
58 | .BR keepalive ": tcp keep alive timer" | |
59 | .P | |
60 | .BR timewait ": timewait stage timer" | |
61 | .P | |
62 | .BR persist ": zero window probe timer" | |
63 | .P | |
64 | .BR unknown ": none of the above timers" | |
65 | .RE | |
66 | .TP | |
67 | .B <expire_time> | |
68 | how long time the timer will expire | |
69 | .P | |
70 | .TP | |
71 | .B <retrans> | |
f76ad635 | 72 | how many times the retransmission occured |
5a9bca71 | 73 | .RE |
d7eeca84 SH |
74 | .TP |
75 | .B \-e, \-\-extended | |
5a9bca71 | 76 | Show detailed socket information. The output format is: |
77 | .RS | |
78 | .P | |
79 | uid:<uid_number> ino:<inode_number> sk:<cookie> | |
80 | .P | |
81 | .TP | |
82 | .B <uid_number> | |
83 | the user id the socket belongs to | |
84 | .P | |
85 | .TP | |
86 | .B <inode_number> | |
87 | the socket's inode number in VFS | |
88 | .P | |
89 | .TP | |
90 | .B <cookie> | |
91 | an uuid of the socket | |
92 | .RE | |
d7eeca84 SH |
93 | .TP |
94 | .B \-m, \-\-memory | |
5a9bca71 | 95 | Show socket memory usage. The output format is: |
96 | .RS | |
97 | .P | |
cffeeb39 | 98 | skmem:(r<rmem_alloc>,rb<rcv_buf>,t<wmem_alloc>,tb<snd_buf>, |
7f504752 LB |
99 | .br |
100 | .RS | |
101 | .RS | |
cffeeb39 LB |
102 | f<fwd_alloc>,w<wmem_queued>, |
103 | .RE | |
104 | .RE | |
105 | .br | |
106 | .RS | |
107 | .RS | |
108 | o<opt_mem>,bl<back_log>) | |
7f504752 LB |
109 | .RE |
110 | .RE | |
5a9bca71 | 111 | .P |
112 | .TP | |
113 | .B <rmem_alloc> | |
114 | the memory allocated for receiving packet | |
115 | .P | |
116 | .TP | |
117 | .B <rcv_buf> | |
118 | the total memory can be allocated for receiving packet | |
119 | .P | |
120 | .TP | |
121 | .B <wmem_alloc> | |
122 | the memory used for sending packet (which has been sent to layer 3) | |
123 | .P | |
124 | .TP | |
125 | .B <snd_buf> | |
126 | the total memory can be allocated for sending packet | |
127 | .P | |
128 | .TP | |
129 | .B <fwd_alloc> | |
f76ad635 SH |
130 | the memory allocated by the socket as cache, but not used for |
131 | receiving/sending packet yet. If need memory to send/receive packet, | |
132 | the memory in this cache will be used before allocate additional | |
133 | memory. | |
5a9bca71 | 134 | .P |
135 | .TP | |
136 | .B <wmem_queued> | |
137 | The memory allocated for sending packet (which has not been sent to layer 3) | |
138 | .P | |
139 | .TP | |
f76ad635 | 140 | .B <ropt_mem> |
5a9bca71 | 141 | The memory used for storing socket option, e.g., the key for TCP MD5 signature |
142 | .P | |
143 | .TP | |
144 | .B <back_log> | |
f76ad635 SH |
145 | The memory used for the sk backlog queue. On a process context, if the |
146 | process is receiving packet, and a new packet is received, it will be | |
147 | put into the sk backlog queue, so it can be received by the process | |
148 | immediately | |
5a9bca71 | 149 | .RE |
d7eeca84 SH |
150 | .TP |
151 | .B \-p, \-\-processes | |
152 | Show process using socket. | |
153 | .TP | |
154 | .B \-i, \-\-info | |
5a9bca71 | 155 | Show internal TCP information. Below fields may appear: |
156 | .RS | |
157 | .P | |
158 | .TP | |
159 | .B ts | |
160 | show string "ts" if the timestamp option is set | |
161 | .P | |
162 | .TP | |
163 | .B sack | |
164 | show string "sack" if the sack option is set | |
165 | .P | |
166 | .TP | |
167 | .B ecn | |
168 | show string "ecn" if the explicit congestion notification option is set | |
169 | .P | |
170 | .TP | |
171 | .B ecnseen | |
172 | show string "ecnseen" if the saw ecn flag is found in received packets | |
173 | .P | |
174 | .TP | |
175 | .B fastopen | |
176 | show string "fastopen" if the fastopen option is set | |
177 | .P | |
178 | .TP | |
179 | .B cong_alg | |
180 | the congestion algorithm name, the default congestion algorithm is "cubic" | |
181 | .P | |
182 | .TP | |
183 | .B wscale:<snd_wscale>:<rcv_wscale> | |
f76ad635 SH |
184 | if window scale option is used, this field shows the send scale factor |
185 | and receive scale factor | |
5a9bca71 | 186 | .P |
187 | .TP | |
188 | .B rto:<icsk_rto> | |
189 | tcp re-transmission timeout value, the unit is millisecond | |
190 | .P | |
191 | .TP | |
192 | .B backoff:<icsk_backoff> | |
f76ad635 SH |
193 | used for exponential backoff re-transmission, the actual |
194 | re-transmission timeout value is icsk_rto << icsk_backoff | |
5a9bca71 | 195 | .P |
196 | .TP | |
197 | .B rtt:<rtt>/<rttvar> | |
f76ad635 SH |
198 | rtt is the average round trip time, rttvar is the mean deviation of |
199 | rtt, their units are millisecond | |
5a9bca71 | 200 | .P |
201 | .TP | |
202 | .B ato:<ato> | |
203 | ack timeout, unit is millisecond, used for delay ack mode | |
204 | .P | |
205 | .TP | |
206 | .B mss:<mss> | |
207 | max segment size | |
208 | .P | |
209 | .TP | |
210 | .B cwnd:<cwnd> | |
211 | congestion window size | |
212 | .P | |
213 | .TP | |
3d791a32 RM |
214 | .B pmtu:<pmtu> |
215 | path MTU value | |
216 | .P | |
217 | .TP | |
5a9bca71 | 218 | .B ssthresh:<ssthresh> |
219 | tcp congestion window slow start threshold | |
220 | .P | |
221 | .TP | |
222 | .B bytes_acked:<bytes_acked> | |
223 | bytes acked | |
224 | .P | |
225 | .TP | |
226 | .B bytes_received:<bytes_received> | |
227 | bytes received | |
228 | .P | |
229 | .TP | |
230 | .B segs_out:<segs_out> | |
231 | segments sent out | |
232 | .P | |
233 | .TP | |
234 | .B segs_in:<segs_in> | |
235 | segments received | |
236 | .P | |
237 | .TP | |
238 | .B send <send_bps>bps | |
239 | egress bps | |
240 | .P | |
241 | .TP | |
242 | .B lastsnd:<lastsnd> | |
243 | how long time since the last packet sent, the unit is millisecond | |
244 | .P | |
245 | .TP | |
246 | .B lastrcv:<lastrcv> | |
247 | how long time since the last packet received, the unit is millisecond | |
248 | .P | |
249 | .TP | |
250 | .B lastack:<lastack> | |
251 | how long time since the last ack received, the unit is millisecond | |
252 | .P | |
253 | .TP | |
254 | .B pacing_rate <pacing_rate>bps/<max_pacing_rate>bps | |
255 | the pacing rate and max pacing rate | |
256 | .P | |
257 | .TP | |
258 | .B rcv_space:<rcv_space> | |
259 | a helper variable for TCP internal auto tuning socket receive buffer | |
260 | .RE | |
d7eeca84 | 261 | .TP |
0f3f0ca3 KK |
262 | .B \-\-tos |
263 | Show ToS and priority information. Below fields may appear: | |
264 | .RS | |
265 | .P | |
266 | .TP | |
267 | .B tos | |
268 | IPv4 Type-of-Service byte | |
269 | .P | |
270 | .TP | |
271 | .B tclass | |
272 | IPv6 Traffic Class byte | |
273 | .P | |
274 | .TP | |
275 | .B class_id | |
f76ad635 SH |
276 | Class id set by net_cls cgroup. If class is zero this shows priority |
277 | set by SO_PRIORITY. | |
0f3f0ca3 KK |
278 | .RE |
279 | .TP | |
fb2594c1 LC |
280 | .B \-K, \-\-kill |
281 | Attempts to forcibly close sockets. This option displays sockets that are | |
282 | successfully closed and silently skips sockets that the kernel does not support | |
283 | closing. It supports IPv4 and IPv6 sockets only. | |
284 | .TP | |
d7eeca84 SH |
285 | .B \-s, \-\-summary |
286 | Print summary statistics. This option does not parse socket lists obtaining | |
287 | summary from various sources. It is useful when amount of sockets is so huge | |
288 | that parsing /proc/net/tcp is painful. | |
289 | .TP | |
d559db72 PS |
290 | .B \-E, \-\-events |
291 | Continually display sockets as they are destroyed | |
292 | .TP | |
116ac927 RH |
293 | .B \-Z, \-\-context |
294 | As the | |
295 | .B \-p | |
296 | option but also shows process security context. | |
297 | .sp | |
298 | For | |
299 | .BR netlink (7) | |
300 | sockets the initiating process context is displayed as follows: | |
301 | .RS | |
302 | .RS | |
303 | .IP "1." 4 | |
304 | If valid pid show the process context. | |
305 | .IP "2." 4 | |
306 | If destination is kernel (pid = 0) show kernel initial context. | |
307 | .IP "3." 4 | |
308 | If a unique identifier has been allocated by the kernel or netlink user, | |
309 | show context as "unavailable". This will generally indicate that a | |
310 | process has more than one netlink socket active. | |
311 | .RE | |
312 | .RE | |
313 | .TP | |
314 | .B \-z, \-\-contexts | |
315 | As the | |
316 | .B \-Z | |
317 | option but also shows the socket context. The socket context is | |
318 | taken from the associated inode and is not the actual socket | |
319 | context held by the kernel. Sockets are typically labeled with the | |
320 | context of the creating process, however the context shown will reflect | |
321 | any policy role, type and/or range transition rules applied, | |
322 | and is therefore a useful reference. | |
323 | .TP | |
95ce04bc VK |
324 | .B \-N NSNAME, \-\-net=NSNAME |
325 | Switch to the specified network namespace name. | |
326 | .TP | |
f3c2f91e | 327 | .B \-b, \-\-bpf |
f76ad635 SH |
328 | Show socket BPF filters (only administrators are allowed to get these |
329 | information). | |
f3c2f91e | 330 | .TP |
d7eeca84 SH |
331 | .B \-4, \-\-ipv4 |
332 | Display only IP version 4 sockets (alias for -f inet). | |
333 | .TP | |
334 | .B \-6, \-\-ipv6 | |
335 | Display only IP version 6 sockets (alias for -f inet6). | |
336 | .TP | |
337 | .B \-0, \-\-packet | |
5d805635 | 338 | Display PACKET sockets (alias for -f link). |
d7eeca84 SH |
339 | .TP |
340 | .B \-t, \-\-tcp | |
5d805635 | 341 | Display TCP sockets. |
d7eeca84 SH |
342 | .TP |
343 | .B \-u, \-\-udp | |
5d805635 | 344 | Display UDP sockets. |
d7eeca84 SH |
345 | .TP |
346 | .B \-d, \-\-dccp | |
5d805635 | 347 | Display DCCP sockets. |
d7eeca84 SH |
348 | .TP |
349 | .B \-w, \-\-raw | |
5d805635 | 350 | Display RAW sockets. |
d7eeca84 SH |
351 | .TP |
352 | .B \-x, \-\-unix | |
5d805635 | 353 | Display Unix domain sockets (alias for -f unix). |
d7eeca84 | 354 | .TP |
f89d46ad PS |
355 | .B \-S, \-\-sctp |
356 | Display SCTP sockets. | |
357 | .TP | |
c759116a SH |
358 | .B \-\-vsock |
359 | Display vsock sockets (alias for -f vsock). | |
360 | .TP | |
2abc3d76 BT |
361 | .B \-\-xdp |
362 | Display XDP sockets (alias for -f xdp). | |
363 | .TP | |
d7eeca84 | 364 | .B \-f FAMILY, \-\-family=FAMILY |
f76ad635 SH |
365 | Display sockets of type FAMILY. Currently the following families are |
366 | supported: unix, inet, inet6, link, netlink, vsock, xdp. | |
d7eeca84 | 367 | .TP |
583de149 | 368 | .B \-A QUERY, \-\-query=QUERY, \-\-socket=QUERY |
d7eeca84 SH |
369 | List of socket tables to dump, separated by commas. The following identifiers |
370 | are understood: all, inet, tcp, udp, raw, unix, packet, netlink, unix_dgram, | |
c759116a | 371 | unix_stream, unix_seqpacket, packet_raw, packet_dgram, dccp, sctp, |
2abc3d76 BT |
372 | vsock_stream, vsock_dgram, xdp Any item in the list may optionally be |
373 | prefixed by an exclamation mark | |
c121111e PS |
374 | .RB ( ! ) |
375 | to exclude that socket table from being dumped. | |
d7eeca84 | 376 | .TP |
583de149 | 377 | .B \-D FILE, \-\-diag=FILE |
f76ad635 SH |
378 | Do not display anything, just dump raw information about TCP sockets |
379 | to FILE after applying filters. If FILE is - stdout is used. | |
d7eeca84 SH |
380 | .TP |
381 | .B \-F FILE, \-\-filter=FILE | |
f76ad635 SH |
382 | Read filter information from FILE. Each line of FILE is interpreted |
383 | like single command line option. If FILE is - stdin is used. | |
d7eeca84 | 384 | .TP |
b93fe578 | 385 | .B FILTER := [ state STATE-FILTER ] [ EXPRESSION ] |
cd258764 | 386 | Please take a look at the official documentation for details regarding filters. |
b93fe578 VK |
387 | |
388 | .SH STATE-FILTER | |
389 | ||
390 | .B STATE-FILTER | |
f76ad635 SH |
391 | allows to construct arbitrary set of states to match. Its syntax is |
392 | sequence of keywords state and exclude followed by identifier of | |
393 | state. | |
b93fe578 VK |
394 | .TP |
395 | Available identifiers are: | |
396 | ||
397 | All standard TCP states: | |
398 | .BR established ", " syn-sent ", " syn-recv ", " fin-wait-1 ", " fin-wait-2 ", " time-wait ", " closed ", " close-wait ", " last-ack ", " | |
ae4e21c9 | 399 | .BR listening " and " closing. |
b93fe578 VK |
400 | |
401 | .B all | |
402 | - for all the states | |
403 | ||
404 | .B connected | |
405 | - all the states except for | |
ae4e21c9 | 406 | .BR listening " and " closed |
b93fe578 VK |
407 | |
408 | .B synchronized | |
409 | - all the | |
410 | .B connected | |
411 | states except for | |
412 | .B syn-sent | |
413 | ||
414 | .B bucket | |
415 | - states, which are maintained as minisockets, i.e. | |
416 | .BR time-wait " and " syn-recv | |
417 | ||
418 | .B big | |
419 | - opposite to | |
420 | .B bucket | |
421 | ||
d7eeca84 SH |
422 | .SH USAGE EXAMPLES |
423 | .TP | |
424 | .B ss -t -a | |
425 | Display all TCP sockets. | |
426 | .TP | |
116ac927 RH |
427 | .B ss -t -a -Z |
428 | Display all TCP sockets with process SELinux security contexts. | |
429 | .TP | |
d7eeca84 SH |
430 | .B ss -u -a |
431 | Display all UDP sockets. | |
432 | .TP | |
433 | .B ss -o state established '( dport = :ssh or sport = :ssh )' | |
434 | Display all established ssh connections. | |
435 | .TP | |
ea5dd59c | 436 | .B ss -x src /tmp/.X11-unix/* |
d7eeca84 SH |
437 | Find all local processes connected to X server. |
438 | .TP | |
439 | .B ss -o state fin-wait-1 '( sport = :http or sport = :https )' dst 193.233.7/24 | |
f76ad635 SH |
440 | List all the tcp sockets in state FIN-WAIT-1 for our apache to network |
441 | 193.233.7/24 and look at their timers. | |
c121111e PS |
442 | .TP |
443 | .B ss -a -A 'all,!tcp' | |
444 | List sockets in all states from all socket tables but TCP. | |
d7eeca84 SH |
445 | .SH SEE ALSO |
446 | .BR ip (8), | |
b93fe578 VK |
447 | .br |
448 | .BR RFC " 793 " | |
5699275b | 449 | - https://tools.ietf.org/rfc/rfc793.txt (TCP states) |
b93fe578 | 450 | |
d7eeca84 | 451 | .SH AUTHOR |
5699275b | 452 | .I ss |
dd8fac8c | 453 | was written by Alexey Kuznetsov, <kuznet@ms2.inr.ac.ru>. |
d7eeca84 SH |
454 | .PP |
455 | This manual page was written by Michael Prokop <mika@grml.org> | |
456 | for the Debian project (but may be used by others). |