blob: e55dd0c96a556a8c05c2593307bb2edcd0b49344 [file] [log] [blame]
.TH SS 8
ss \- another utility to investigate sockets
.B ss
.RI [ options ] " [ FILTER ]"
.B ss
is used to dump socket statistics. It allows showing information similar
.IR netstat .
It can display more TCP and state informations than other tools.
When no option is used ss displays a list of
open non-listening TCP sockets that have established connection.
.B \-h, \-\-help
Show summary of options.
.B \-V, \-\-version
Output version information.
.B \-n, \-\-numeric
Do not try to resolve service names.
.B \-r, \-\-resolve
Try to resolve numeric address/ports.
.B \-a, \-\-all
Display both listening and non-listening (for TCP this means established connections) sockets.
.B \-l, \-\-listening
Display only listening sockets (these are omitted by default).
.B \-o, \-\-options
Show timer information.
.B \-e, \-\-extended
Show detailed socket information
.B \-m, \-\-memory
Show socket memory usage.
.B \-p, \-\-processes
Show process using socket.
.B \-i, \-\-info
Show internal TCP information.
.B \-s, \-\-summary
Print summary statistics. This option does not parse socket lists obtaining
summary from various sources. It is useful when amount of sockets is so huge
that parsing /proc/net/tcp is painful.
.B \-b, \-\-bpf
Show socket BPF filters (only administrators are allowed to get these information).
.B \-4, \-\-ipv4
Display only IP version 4 sockets (alias for -f inet).
.B \-6, \-\-ipv6
Display only IP version 6 sockets (alias for -f inet6).
.B \-0, \-\-packet
Display PACKET sockets (alias for -f link).
.B \-t, \-\-tcp
Display TCP sockets.
.B \-u, \-\-udp
Display UDP sockets.
.B \-d, \-\-dccp
Display DCCP sockets.
.B \-w, \-\-raw
Display RAW sockets.
.B \-x, \-\-unix
Display Unix domain sockets (alias for -f unix).
.B \-f FAMILY, \-\-family=FAMILY
Display sockets of type FAMILY.
Currently the following families are supported: unix, inet, inet6, link, netlink.
.B \-A QUERY, \-\-query=QUERY, \-\-socket=QUERY
List of socket tables to dump, separated by commas. The following identifiers
are understood: all, inet, tcp, udp, raw, unix, packet, netlink, unix_dgram,
unix_stream, packet_raw, packet_dgram.
.B \-D FILE, \-\-diag=FILE
Do not display anything, just dump raw information about TCP sockets to FILE after applying filters. If FILE is - stdout is used.
.B \-F FILE, \-\-filter=FILE
Read filter information from FILE.
Each line of FILE is interpreted like single command line option. If FILE is - stdin is used.
Please take a look at the official documentation (Debian package iproute-doc) for details regarding filters.
.B ss -t -a
Display all TCP sockets.
.B ss -u -a
Display all UDP sockets.
.B ss -o state established '( dport = :ssh or sport = :ssh )'
Display all established ssh connections.
.B ss -x src /tmp/.X11-unix/*
Find all local processes connected to X server.
.B ss -o state fin-wait-1 '( sport = :http or sport = :https )' dst 193.233.7/24
List all the tcp sockets in state FIN-WAIT-1 for our apache to network 193.233.7/24 and look at their timers.
.BR ip (8),
.BR /usr/share/doc/iproute-doc/ss.html " (package iprouteĀ­doc)"
.I ss
was written by Alexey Kuznetosv, <>.
This manual page was written by Michael Prokop <>
for the Debian project (but may be used by others).