linux ss 是一个用于统计socket信息的工具,用于替代netstat. 当信息量较大时,ss比较有优势。
命令选项
Usage:
ss [options]
ss [options] [filter]
-h, --help this message
-V, --version output version information
-n, --numeric don't resolve service names
-r, --resolve resolve host names
-a, --all display all sockets
-l, --listening display listening sockets
-o, --options show timer information
-e, --extended show detailed socket information
-m, --memory show socket memory usage
-p, --processes show process using socket
-i, --info show internal TCP information
-s, --summary show socket usage summary
-4, --ipv4 display only IP version 4 sockets
-6, --ipv6 display only IP version 6 sockets
-0, --packet display PACKET sockets
-t, --tcp display only TCP sockets
-u, --udp display only UDP sockets
-d, --dccp display only DCCP sockets
-w, --raw display only RAW sockets
-x, --unix display only Unix domain sockets
-f, --family=FAMILY display sockets of type FAMILY
-A, --query=QUERY, --socket=QUERY
QUERY := {all|inet|tcp|udp|raw|unix|packet|netlink}[,QUERY]
-D, --diag=FILE Dump raw information about TCP sockets to FILE
-F, --filter=FILE read filter information from FILE
FILTER := [ state TCP-STATE ] [ EXPRESSION ]
用法
ss -ta dumps all TCP socket
ss -ua dumps all UDP sockets
ss -wa dumps all RAW sockets
ss -xa dumps all UNIX sockets
ss -4a dumps all IPV4 sockets
ss -6a dumps all IPV6 sockets
过滤选项
ss可以很方便的使用TCP states对结果进行过滤,可用的状态如下:
established
syn-sent
syn-recv
fin-wait-1
fin-wait-2
time-wait
closed
close-wait
last-ack
listening
closing
还有几个比较特殊的状态:
all (all of the above states)
connected (all the states with the exception of listen and closed)
synchronized (all of the connected states with the exception of syn-sent)
bucket (states which are maintained as minisockets, for example time-wait and
syn-recv)
big (Opposite to bucket state)
例子
ss -at state listening
ss -at state connected