- Show all TCP/UDP/RAW/UNIX sockets:ss -a [-t|-u|-w|-x]- Filter TCP sockets by states, only/exclude:ss [state/exclude] [bucket/big/connected/synchronized/...]- Show all TCP sockets connected to the local HTTPS port (443):ss -t src :- Show all TCP sockets along with processes connected to a remote ssh port:ss -pt dst :[ssh]- Show all UDP sockets connected on specific source and destination ports:ss -u 'sport == :[source_port] and dport == :[destination_port]'- Show all TCP IPv4 sockets locally connected on the subnet 192.168.0.0/16:ss -4t src [192.168/16]
ss [options] [ FILTER ]
ss is used to dump socket statistics. It allows showing information similar to netstat. It can display more TCP and state informations than other tools.
When no option is used ss displays a list of open non-listening sockets (e.g. TCP/UNIX/UDP) that have established connection.
For netlink(7) sockets the initiating process context is displayed as follows:
STATE-FILTER allows to construct arbitrary set of states to match. Its syntax is sequence of keywords state and exclude followed by identifier of state.
All standard TCP states: established, syn-sent, syn-recv, fin-wait-1, fin-wait-2, time-wait, closed, close-wait, last-ack, listen and closing.
all - for all the states
connected - all the states except for listen and closed
synchronized - all the connected states except for syn-sent
bucket - states, which are maintained as minisockets, i.e. time-wait and syn-recv
big - opposite to bucket
ip(8), /usr/share/doc/iproute-doc/ss.html (package iproutedoc), RFC 793 - https://tools.ietf.org/rfc/rfc793.txt (TCP states)
ss was written by Alexey Kuznetsov, <email@example.com>.
This manual page was written by Michael Prokop <firstname.lastname@example.org> for the Debian project (but may be used by others).