BIP KB:
How To Use SS Command : Alternate For Netstat

In case you are looking for an alternate of netstat command, it's called ss command. By default ss command is shipped with package called iproute (Advanced IP routing and network device configuration tools)

Introduction of ss

ss command is another utility to investigate sockets. It is used to dump socket statistics. It  shows information similar to netstat and displays more TCP and state informations than most other tools. It's considered as alternate of netstat command also.

Check ss version

Use the -V argument with ss command. It will show the version information # ss -V ss utility, iproute2-ss130716

Examples with ss command utility

Example 1. Display only listening sockets . Use argument -l

# ss -l

Example 2. Display all listened and non listened sockets . Use argument -a

# ss -a

Example 3. Display TCP sockets. Use argument -t or –tcp. Try it with -l argument, it will print all the listening TCP sockets.

ss -t

Sample:

[root@yourserver ~]# ss -t
State       Recv-Q Send-Q                                      Local Address:Port                                          Peer Address:Port   
ESTAB       0      0                                          192.168.56.101:ssh                                           192.168.56.1:38153   
[root@yourserver ~]# 
[root@yourserver ~]# ss -tl
State       Recv-Q Send-Q                                      Local Address:Port                                          Peer Address:Port   
LISTEN      0      100                                             127.0.0.1:smtp                                                     *:*       
LISTEN      0      128                                                     *:ssh                                                      *:*       
LISTEN      0      100                                                   ::1:smtp                                                    :::*       
LISTEN      0      128                                                    :::ssh                                                     :::*       
[root@nix ~]#

Example 4. Display UDP sockets. Use the argument -u or –udp . Try it with -l argument

ss -u

Sample:

[root@yourserver ~]# ss -u
State       Recv-Q Send-Q                                      Local Address:Port                                          Peer Address:Port   
[root@yourserver ~]# 
[root@yourserver ~]# ss -ul
State       Recv-Q Send-Q                                      Local Address:Port                                          Peer Address:Port   
UNCONN      0      0                                                       *:43923                                                    *:*       
UNCONN      0      0                                                       *:39372                                                    *:*       
UNCONN      0      0                                                       *:bootpc                                                   *:*       
UNCONN      0      0                                                       *:bootpc                                                   *:*       
UNCONN      0      0                                                       *:mdns                                                     *:*       
UNCONN      0      0                                                       *:28977                                                    *:*       
UNCONN      0      0                                                      :::39372                                                   :::*       
UNCONN      0      0                                                      :::53064                                                   :::*       
[root@yourserver ~]#

Example 5. Show process using socket. Use argument -p or –processes. Try with other arguments

ss -p

Sample:

[root@yourserver ~]# ss -ltp
State       Recv-Q Send-Q                                      Local Address:Port                                          Peer Address:Port   
LISTEN      0      100                                             127.0.0.1:smtp                                                     *:*        users:(("master",1785,13))
LISTEN      0      128                                                     *:ssh                                                      *:*        users:(("sshd",1036,3))
LISTEN      0      100                                                   ::1:smtp                                                    :::*        users:(("master",1785,14))
LISTEN      0      128                                                    :::ssh                                                     :::*        users:(("sshd",1036,4))
[root@yourserver ~]#

Example 6. Show socket memory usage. Use argument -m or –memory

ss -m

Sample:

[root@yourserver ~]# ss -mta
State       Recv-Q Send-Q                                      Local Address:Port                                          Peer Address:Port   
LISTEN      0      100                                             127.0.0.1:smtp                                                     *:*       
	 skmem: (r0,rb87380,t0,tb16384,f0,w0,o0,bl0)
LISTEN      0      128                                                     *:ssh                                                      *:*       
	 skmem: (r0,rb87380,t0,tb16384,f0,w0,o0,bl0)
ESTAB       0      0                                          192.168.56.101:ssh                                           192.168.56.1:38153   
	 skmem: (r0,rb87380,t0,tb23080,f4096,w0,o0,bl0)
LISTEN      0      100                                                   ::1:smtp                                                    :::*       
	 skmem: (r0,rb87380,t0,tb16384,f0,w0,o0,bl0)
LISTEN      0      128                                                    :::ssh                                                     :::*       
	 skmem: (r0,rb87380,t0,tb16384,f0,w0,o0,bl0)
[root@yourserver ~]#

The manual of ss utility is very helpful. To explore, use the command man ss for man pages. Or you use the command ss --help for getting help. Reference of ss -help command

[root@yourserver ~]# ss -help
Usage: ss [ OPTIONS ]
       ss [ OPTIONS ] [ FILTER ]
   -h, --help		this message
   -V, --version	output version information
   -n, --numeric	don't resolve service names
   -r, --resolve       resolve host names
   -a, --all		display all sockets
   -l, --listening	display listening sockets
   -o, --options       show timer information
   -e, --extended      show detailed socket information
   -m, --memory        show socket memory usage
   -p, --processes	show process using socket
   -i, --info		show internal TCP information
   -s, --summary	show socket usage summary
   -b, --bpf           show bpf filter socket information

   -4, --ipv4          display only IP version 4 sockets
   -6, --ipv6          display only IP version 6 sockets
   -0, --packet	display PACKET sockets
   -t, --tcp		display only TCP sockets
   -u, --udp		display only UDP sockets
   -d, --dccp		display only DCCP sockets
   -w, --raw		display only RAW sockets
   -x, --unix		display only Unix domain sockets
   -f, --family=FAMILY display sockets of type FAMILY

   -A, --query=QUERY, --socket=QUERY
       QUERY := {all|inet|tcp|udp|raw|unix|packet|netlink}[,QUERY]

   -D, --diag=FILE     Dump raw information about TCP sockets to FILE
   -F, --filter=FILE   read filter information from FILE
       FILTER := [ state TCP-STATE ] [ EXPRESSION ]
[root@yourserver ~]# 

Tags: tools, command, advanced IP routing, iproute, Netstat, network device configuration, SS, SS Command

Leave a Reply