编程知识 cdmana.com

How to use SS command in Linux network state tool

ss The command is used to display socket state . He can show PACKET sockets, TCP sockets, UDP sockets, DCCP sockets, RAW sockets, Unix domain sockets And so on . It has more to show than other tools tcp and state Information . It's a very practical 、 Fast 、 Effective tracking IP The connection and sockets New tools for .SS command You can provide the following information :

  • be-all TCP sockets
  • be-all UDP sockets
  • all ssh/ftp/ttp/https Persistent connection
  • All connections to Xserver Local processes of
  • Use state( for example :connected, synchronized, SYN-RECV, SYN-SENT,TIME-WAIT)、 Address 、 Port filtering
  • be-all state FIN-WAIT-1 tcpsocket Connect and more

Many popular Linux The distribution supports ss And a lot of monitoring tools ss command . Familiarity with this tool will help you better discover and solve system performance problems . I strongly recommend the use of ss Command substitution netstat Some commands , for example netsat -ant/lnt etc. .

Show him here for a comparison , Count the number of concurrent connections to the server

netstat
# time netstat -ant | grep EST | wc -l
3100
real 0m12.960s
user 0m0.334s
sys 0m12.561s
# time ss -o state established | wc -l
3204
real 0m0.030s
user 0m0.005s
sys 0m0.026s

The results are clear ss Statistics of the number of concurrent connections, efficiency wins netstat, stay ss If you can handle it , You will also be choosing netstat Do you , Still hesitating , See the following example , Or jump to the help page .

Commonly used ss command :

  • ss -l Show all ports opened locally
  • ss -pl Show the specific open socket
  • ss -t -a Show all tcp socket
  • ss -u -a Show all UDP Socekt
  • ss -o state established '( dport = :smtp or sport = :smtp )' Show all established SMTP Connect
  • ss -o state established '( dport = :http or sport = :http )' Show all established HTTP Connect
  • ss -x src /tmp/.X11-unix/* Find all connections X Process of server
  • ss -s List current socket Details :

Show sockets Brief information , List currently connected , close , Waiting for the tcp Connect

# ss -s
Total: 3519 (kernel 3691)
TCP: 26557 (estab 3163, closed 23182, orphaned 194, synrecv 0, timewait 23182/0), ports 1452
Transport Total IP IPv6
* 3691 - -
RAW 2 2 0
UDP 10 7 3
TCP 3375 3368 7
INET 3387 3377 10
FRAG 0 0 0

List the current listening ports

# ss -lRecv-Q Send-Q Local Address:Port Peer Address:Port
0 10 :::5989 :::*
0 5 *:rsync *:*
0 128 :::sunrpc :::*
0 128 *:sunrpc *:*
0 511 *:http *:*
0 128 :::ssh :::*
0 128 *:ssh *:*
0 128 :::35766 :::*
0 128 127.0.0.1:ipp *:*
0 128 ::1:ipp :::*
0 100 ::1:smtp :::*
0 100 127.0.0.1:smtp *:*
0 511 *:https *:*
0 100 :::1311 :::*
0 5 *:5666 *:*
0 128 *:3044 *:*

ss List each process name and the port it listens on

# ss -pl

ss List all the tcp sockets

# ss -t -a

ss List all udp sockets

# ss -u -a

ss List all http Connection in connection

# ss -o state established '( dport = :http or sport = :http )'

The above includes the external supply of 80, And access to external 80. Perfect substitute for the above command netstat obtain http Number of concurrent connections , Monitoring is often used to

ss List which local processes connect to x server

# ss -x src /tmp/.X11-unix/*

ss It is listed in FIN-WAIT-1 State of http、https Connect

# ss -o state fin-wait-1 '( sport = :http or sport = :https )'

ss frequently-used state state :

  • established
  • syn-sent
  • syn-recv
  • fin-wait-1
  • fin-wait-2
  • time-wait
  • closed
  • close-wait
  • last-ack
  • listen
  • closing
  • all : All of the above states
  • connected : All the states except for listen and closed
  • synchronized : All the connected states except for syn-sent
  • bucket : Show states, which are maintained as minisockets, i.e. time-wait and syn-recv.
  • big : Opposite to bucket state.

ss Use IP Address screening

  • ss src ADDRESS_PATTERN
  • src: Indicates the source
  • ADDRESS_PATTERN: Address rules

as follows :

ss src 120.33.31.1 
#  List it 20.33.31.1 The connection of 
#  List it to 120.33.31.1,80 Port connection 
ss src 120.33.31.1:http
ss src 120.33.31.1:8

ss Use port filtering

  • ss dport OP PORT
  • OP: It's the operator
  • PORT: Represents a port
  • dport: Indicates the filtering target port 、 On the contrary sport

OP The operators are as follows :

<= or le :  Less than or equal to  >= or ge :  Greater than or equal to 
== or eq :  be equal to 
!= or ne :  It's not the port 
< or lt :  Less than this port  > or gt :  Greater than port 

OP example

ss sport = :http  It can also be  ss sport = :80
ss dport = :http
ss dport > :1024
ss sport > :1024
ss sport < :32000
ss sport eq :22
ss dport != :22
ss state connected sport = :http
ss ( sport = :http or sport = :https )
ss -o state fin-wait-1 ( sport = :http or sport = :https ) dst 192.168.1/24

Why? ss Than netstat fast :

netstat Is traversal /proc Each of the following PID Catalog ,ss Direct reading /proc/net The following statistics . therefore ss Execution consumes more resources and time than netstat A lot less

ss Order help

# ss -h
Usage: ss [ OPTIONS ]
       ss [ OPTIONS ] [ FILTER ]
   -h, --help           this message
   -V, --version        output version information
   -n, --numeric        don't resolve service names
   -r, --resolve       resolve host names
   -a, --all            display all sockets
   -l, --listening      display listening sockets
   -o, --options       show timer information
   -e, --extended      show detailed socket information
   -m, --memory        show socket memory usage
   -p, --processes      show process using socket
   -i, --info           show internal TCP information
   -s, --summary        show socket usage summary
   -4, --ipv4          display only IP version 4 sockets
   -6, --ipv6          display only IP version 6 sockets
   -0, --packet display PACKET sockets
   -t, --tcp            display only TCP sockets
   -u, --udp            display only UDP sockets
   -d, --dccp           display only DCCP sockets
   -w, --raw            display only RAW sockets
   -x, --unix           display only Unix domain sockets
   -f, --family=FAMILY display sockets of type FAMILY
   -A, --query=QUERY, --socket=QUERY
       QUERY := {all|inet|tcp|udp|raw|unix|packet|netlink}[,QUERY]
   -D, --diag=FILE      Dump raw information about TCP sockets to FILE
   -F, --filter=FILE   read filter information from FILE
       FILTER := [ state TCP-STATE ] [ EXPRESSION ]
source :www.ttlsa.com/linux-command/ss-replace-netstat/

image

版权声明
本文为[Migrant worker brother]所创,转载请带上原文链接,感谢

Scroll to Top