1SS(8) System Manager's Manual SS(8)
2
6 ss - another utility to investigate sockets
7
9 ss [options] [ FILTER ]
10
12 ss is used to dump socket statistics. It allows showing information
13 similar to netstat. It can display more TCP and state informations
14 than other tools.
15
18 When no option is used ss displays a list of open non-listening TCP
19 sockets that have established connection.
20 These programs follow the usual GNU command line syntax, with long
22 options starting with two dashes (`-'). A summary of options is
23 included below.
24 -h, --help
26 Show summary of options.
27 -V, --version
29 Output version information.
30 -n, --numeric
32 Do now try to resolve service names.
33 -r, --resolve
35 Try to resolve numeric address/ports.
36 -a, --all
38 Display both listening and non-listening (for TCP this means
39 established connections) sockets.
40 -l, --listening
42 Display only listening sockets (these are omitted by default).
43 -o, --options
45 Show timer information.
46 -e, --extended
48 Show detailed socket information
49 -m, --memory
51 Show socket memory usage.
52 -p, --processes
54 Show process using socket.
55 -i, --info
57 Show internal TCP information.
58 -s, --summary
60 Print summary statistics. This option does not parse socket
61 lists obtaining summary from various sources. It is useful when
62 amount of sockets is so huge that parsing /proc/net/tcp is
63 painful.
64 -4, --ipv4
66 Display only IP version 4 sockets (alias for -f inet).
67 -6, --ipv6
69 Display only IP version 6 sockets (alias for -f inet6).
70 -0, --packet
72 Display PACKET sockets (alias for -f link).
73 -t, --tcp
75 Display TCP sockets.
76 -u, --udp
78 Display UDP sockets.
79 -d, --dccp
81 Display DCCP sockets.
82 -w, --raw
84 Display RAW sockets.
85 -x, --unix
87 Display Unix domain sockets (alias for -f unix).
88 -f FAMILY, --family=FAMILY
90 Display sockets of type FAMILY. Currently the following fami‐
91 lies are supported: unix, inet, inet6, link, netlink.
92 -A QUERY, --query=QUERY, --socket=QUERY
94 List of socket tables to dump, separated by commas. The follow‐
95 ing identifiers are understood: all, inet, tcp, udp, raw, unix,
96 packet, netlink, unix_dgram, unix_stream, packet_raw,
97 packet_dgram.
98 -D FILE, --diag=FILE
100 Do not display anything, just dump raw information about TCP
101 sockets to FILE after applying filters. If FILE is - stdout is
102 used.
103 -F FILE, --filter=FILE
105 Read filter information from FILE. Each line of FILE is inter‐
106 preted like single command line option. If FILE is - stdin is
107 used.
108 FILTER := [ state TCP-STATE ] [ EXPRESSION ]
110 Please take a look at the official documentation (Debian package
111 iproute-doc) for details regarding filters.
112
114 ss -t -a
115 Display all TCP sockets.
116 ss -u -a
118 Display all UDP sockets.
119 ss -o state established '( dport = :ssh or sport = :ssh )'
121 Display all established ssh connections.
122 ss -x src /tmp/.X11-unix/*
124 Find all local processes connected to X server.
125 ss -o state fin-wait-1 '( sport = :http or sport = :https )' dst
127 193.233.7/24
128 List all the tcp sockets in state FIN-WAIT-1 for our apache to
129 network 193.233.7/24 and look at their timers.
130
132 ip(8), /usr/share/doc/iproute-doc-2.6.32/ss.ps (package iproute-doc)
133
135 ss was written by Alexey Kuznetosv, <kuznet@ms2.inr.ac.ru>.
136 This manual page was written by Michael Prokop <mika@grml.org> for the
138 Debian project (but may be used by others).
139 SS(8)