N-day learning of a Linux command SS

Use

Output socket statistics, when no parameters are displayed by default is the list of established sockets

Usage

ss [options] [ FILTER ]

Common options

-H,--help
Display Help information

-V,--version
Display version Information

-N,--numeric
Numbers in lieu of name display

-R,--resolve
Exactly the opposite of the-n option

-A,--all
Show connections for all States

-L,--listening
Show only connections for listening status

-O,--options
Display timer information

-E,--extended
Show detailed socket information

-M,--memory
Show socket Memory usage

-P,--processes
Show Process Name

-I.,--info
To display statistics inside TCP

-S,--summary
Output Network Connection statistics

-4,--ipv4
Only IPv4 sockets are displayed

-6,--ipv6
Only IPv6 sockets are displayed

-0,--packet
Show Packet socket

-T,--tcp
Display TCP

-U,--UDP
Show UDP

-D,--DCCP
Show DCCP

-W,--raw
Show Raw

-X,--unix
Show Unix domain sockets

-F FAMILY,--family=family
Show the Protocol family, currently only supported; Unix, inet, Inet6, Link,netlink

-A QUERY,--query=query,--socket=query
List of sockets tables to dumps, separated by commas. The following identifiers is Understood:all, INET,TCP, UDP, Raw, UNIX, packet, NetLink, Unix_dgram, Unix_stream, packet_ Raw, Packet_dgram.

-D FILE,--diag=file
Do not display anything, just dump raw information about the TCP sockets to FILE after applying filters. If FILE is-stdout is used.

-F FILE,--filter=file
Read filter information from FILE. Each line of the FILE is interpreted like single command line option. If FILE Is-stdin is used.

FILTER: = [State Tcp-state] [EXPRESSION]
Official documentation (Debian package Iproute-doc) for details regarding filters.

Practice

1 Show all TCP connections

Ss-t-A

2 Show all UDP connections

Ss-u-A

3 Show all established SSH connections

[[email protected] ~]# ss -o state established '( dport = :ssh or sport = :ssh )'Recv-Q Send-Q                                      Local Address:Port                                          Peer Address:Port   0      0                                                10.0.2.4:ssh                                               10.0.2.2:51447    timer:(keepalive,87min,0)0      0                                                10.0.2.4:ssh                                               10.0.2.2:51445    timer:(keepalive,86min,0)

4 querying a process connected to a local x server

[[email protected] ~]# ss -x src /tmp/.X11-unix/*Netid State      Recv-Q Send-Q                               Local Address:Port                                   Peer Address:Port   You have new mail in /var/spool/mail/root

5 Find the HTTP (s) connection where the status is fin-wait-1 and the destination network segment is 193.233.7/24

[[email protected] ~]# ss -o state fin-wait-1 '( sport = :http or sport = :https )' dst 193.233.7/24Recv-Q Send-Q                                      Local Address:Port                                          Peer Address:Port   You have new mail in /var/spool/mail/root

Resources

"1" Man SS

N-day learning of a Linux command SS