ss Command - Sockets and Ports
-
1. List Established Connections
By default if we run the ss command with no further options specified it will display a list of open non-listening sockets that have established connections, so for example TCP, UDP or UNIX sockets.
[root@centos7 ~]# ss | head -n 5 Netid State Recv-Q Send-Q Local Address:Port Peer Address:Port u_str ESTAB 0 0 * 23740 * 23739 u_str ESTAB 0 0 * 23707 * 23706 u_str ESTAB 0 0 * 87021 * 88383 u_str ESTAB 0 0 * 17056 * 17112
In the above example I have limited the output, on my server I have over 500 lines printed out by running the ss command, so you may wish to pipe it into something like less to easily read it, or otherwise append additional options on the end to only show what you’re after.
-
2. Show Listening Sockets
Rather than listing all sockets, we can use the -l option to specifically list the sockets that are currently listening for a connection.
[root@centos7 ~]# ss -lt State Recv-Q Send-Q Local Address:Port Peer Address:Port LISTEN 0 2 *:kerberos-adm *:* LISTEN 0 128 *:sunrpc *:* LISTEN 0 5 *:kpasswd *:* LISTEN 0 10 192.168.1.14:domain *:* LISTEN 0 10 127.0.0.1:domain *:* LISTEN 0 5 192.168.122.1:domain *:* LISTEN 0 128 *:ssh *:*
In this example we have also used the -t option to only list TCP, more on this later. In future examples you will see that we will combine multiple options like this in order to quickly filter down to what we’re after.
-
3. Show Processes
We can print out the process or PID number that owns a socket with the -p option.
[root@centos7 ~]# ss -pl Netid State Recv-Q Send-Q Local Address:Port Peer Address:Port tcp LISTEN 0 128 :::http :::* users:(("httpd",pid=10522,fd=4),("httpd",pid=10521,fd=4),("httpd",pid=10520,fd=4),("httpd",pid=10519,fd=4),("httpd",pid=10518,fd=4),("httpd",pid=10516,fd=4))In the above example I have only listed a single result, without any further options the full output of ss prints out over 500 lines to stdout. Regardless, we can see the process ID’s of the various Apache processes that are running on this server.
-
4. Don’t Resolve Service Names
By default ss will only resolve port numbers as we have previously seen, for example in the line below we can see 192.168.1.14:ssh where ssh is listed as the local port.
[root@centos7 ~]# ss Netid State Recv-Q Send-Q Local Address:Port Peer Address:Port tcp ESTAB 0 64 192.168.1.14:ssh 192.168.1.191:57091
However if we specify the -n option, this resolution will not take place and we will instead see the port number rather than the service name.
[root@centos7 ~]# ss -n Netid State Recv-Q Send-Q Local Address:Port Peer Address:Port tcp ESTAB 0 0 192.168.1.14:22 192.168.1.191:57091
Note that :22 is now displayed rather than :ssh as we have disabled all name resolution of hostnames and ports. You can check the /etc/services file to see a full list of which ports map to which services.
-
5. Resolve Numeric Address/Ports
We can also do the opposite of this and resolve both the IP address and port number with the -r option. With this we now see the hostname of the 192.168.1.14 server listed.
[root@centos7 ~]# ss -r Netid State Recv-Q Send-Q Local Address:Port Peer Address:Port tcp ESTAB 0 64 centos7.example.com:ssh 192.168.1.191:57091
-
6. IPv4 Sockets
We can use the -4 option to only display information corresponding to IPv4 sockets. In the below example we also make use of the -l option to list everything listening on an IPv4 address.
[root@centos7 ~]# ss -l4 Netid State Recv-Q Send-Q Local Address:Port Peer Address:Port udp UNCONN 0 0 127.0.0.1:323 *:* udp UNCONN 0 0 192.168.122.1:domain *:* udp UNCONN 0 0 *%virbr0:bootps *:* udp UNCONN 0 0 *:bootpc *:* tcp LISTEN 0 128 *:sunrpc *:* tcp LISTEN 0 5 192.168.122.1:domain *:* tcp LISTEN 0 128 *:ssh *:* tcp LISTEN 0 128 127.0.0.1:ipp *:* tcp LISTEN 0 100 127.0.0.1:smtp *:*
-
7. IPv6 Sockets
Likewise, we can use the -6 option to only display information related to IPv6 sockets. In the below example we also make use of the -l option to list everything listening on an IPv6 address.
[root@centos7 ~]# ss -l6 Netid State Recv-Q Send-Q Local Address:Port Peer Address:Port udp UNCONN 0 0 :::ipv6-icmp :::* udp UNCONN 0 0 :::22834 :::* udp UNCONN 0 0 ::1:323 :::* tcp LISTEN 0 128 :::sunrpc :::* tcp LISTEN 0 128 :::http :::* tcp LISTEN 0 128 :::ssh :::* tcp LISTEN 0 128 ::1:ipp :::* tcp LISTEN 0 100 ::1:smtp :::*
-
8. TCP Only
The -t option can be used to display only TCP sockets. When combined with -l to only print out listening sockets we can see everything listening on TCP.
[root@centos7 ~]# ss -lt State Recv-Q Send-Q Local Address:Port Peer Address:Port LISTEN 0 128 *:sunrpc *:* LISTEN 0 5 192.168.122.1:domain *:* LISTEN 0 128 *:ssh *:* LISTEN 0 128 127.0.0.1:ipp *:* LISTEN 0 100 127.0.0.1:smtp *:* LISTEN 0 128 :::sunrpc :::* LISTEN 0 128 :::http :::* LISTEN 0 128 :::ssh :::* LISTEN 0 128 ::1:ipp :::* LISTEN 0 100 ::1:smtp :::*
-
9. UDP Only
The -u option can be used to display only UDP sockets. As UDP is a connection-less protocol, simply running with only the -u option will display no output. We can instead combine this with the -a or -l option to see all listening UDP sockets, as shown below.
[root@centos7 ~]# ss -ul State Recv-Q Send-Q Local Address:Port Peer Address:Port UNCONN 0 0 *:mdns *:* UNCONN 0 0 *:kpasswd *:* UNCONN 0 0 *:839 *:* UNCONN 0 0 *:36812 *:* UNCONN 0 0 192.168.122.1:domain *:* UNCONN 0 0 192.168.1.14:domain *:*
-
10. Unix Sockets
The -x option can be used to display unix domain sockets only.
[root@centos7 ~]# ss -x Netid State Recv-Q Send-Q Local Address:Port Peer Address:Port u_str ESTAB 0 0 @/tmp/.X11-unix/X0 27818 * 27817 u_str ESTAB 0 0 @/tmp/.X11-unix/X0 26656 * 26655 u_str ESTAB 0 0 * 28344 * 26607 u_str ESTAB 0 0 * 24704 * 24705 u_str ESTAB 0 0 @/tmp/.X11-unix/X0 25195 * 24086 u_str ESTAB 0 0 @/tmp/dbus-CRqRiw6V 28388 * 28693 ...
-
11. Display All Information
the -a option shows all, both listening and non-listening sockets. In the case of TCP this means established connections. This option is useful for combining with others, for instance to show all UDP sockets we can add -a, as by default with just the -u option we don’t see as much information.
[root@centos7 ~]# ss -u Recv-Q Send-Q Local Address:Port Peer Address:Port 0 0 192.168.1.14:56658 129.250.35.251:ntp [root@centos7 ~]# ss -ua State Recv-Q Send-Q Local Address:Port Peer Address:Port UNCONN 0 0 *:mdns *:* UNCONN 0 0 127.0.0.1:323 *:* ESTAB 0 0 192.168.1.14:56658 129.250.35.251:ntp UNCONN 0 0 *:21014 *:* UNCONN 0 0 *:60009 *:* UNCONN 0 0 192.168.122.1:domain *:* UNCONN 0 0 *%virbr0:bootps *:* UNCONN 0 0 *:bootpc *:* UNCONN 0 0 ::1:323 :::* UNCONN 0 0 :::43209 :::*
-
12. Show Socket Memory Usage
The -m option can be used to display the amount of memory that each socket is using.
[root@centos7 ~]# ss -ltm State Recv-Q Send-Q Local Address:Port Peer Address:Port LISTEN 0 128 *:sunrpc *:* skmem:(r0,rb87380,t0,tb16384,f0,w0,o0,bl0) LISTEN 0 5 192.168.122.1:domain *:* skmem:(r0,rb87380,t0,tb16384,f0,w0,o0,bl0) LISTEN 0 128 *:ssh *:* skmem:(r0,rb87380,t0,tb16384,f0,w0,o0,bl0) LISTEN 0 128 127.0.0.1:ipp *:* skmem:(r0,rb87380,t0,tb16384,f0,w0,o0,bl0) LISTEN 0 100 127.0.0.1:smtp *:* skmem:(r0,rb87380,t0,tb16384,f0,w0,o0,bl0)
-
13. Show Internal TCP Information
We can request additional internal TCP information with the -i info option.
[root@centos7 ~]# ss -lti State Recv-Q Send-Q Local Address:Port Peer Address:Port LISTEN 0 128 *:sunrpc *:* cubic rto:1000 mss:536 cwnd:10 lastsnd:373620 lastrcv:373620 lastack:373620 LISTEN 0 5 192.168.122.1:domain *:* cubic rto:1000 mss:536 cwnd:10 lastsnd:373620 lastrcv:373620 lastack:373620 LISTEN 0 128 *:ssh *:* cubic rto:1000 mss:536 cwnd:10 segs_in:2 lastsnd:373620 lastrcv:373620 lastack:373620 LISTEN 0 128 127.0.0.1:ipp *:* cubic rto:1000 mss:536 cwnd:10 lastsnd:373620 lastrcv:373620 lastack:373620 LISTEN 0 100 127.0.0.1:smtp *:* cubic rto:1000 mss:536 cwnd:10 lastsnd:373620 lastrcv:373620 lastack:373620
Underneath each listening socket we can see additional information. Note that the -i option does not work with UDP, if you instead specify -u instead of -t this extra information will not be present.
-
14. Show Summary
We can see a quick overview of the statistics with the -s option.
[root@centos7 ~]# ss -s Total: 1253 (kernel 1721) TCP: 13 (estab 1, closed 2, orphaned 0, synrecv 0, timewait 0/0), ports 0 Transport Total IP IPv6 * 1721 - - RAW 1 0 1 UDP 9 7 2 TCP 11 6 5 INET 21 13 8 FRAG 0 0 0
This quickly allows us to see things like the total number of established connections, as well as counts of each type of socket and whether IPv4 or IPv6 is in use.
-
15. Filter Based On State
We can specify the state of a socket to only print out sockets in this state. For example we can specify states including established, syn-sent, syn-recv, fin-wait-1, fin-wait-2, time-wait, closed, closed-wait, last-ack, listen and closing. The below example shows all established TCP connections. To generate this I was connected to the server by SSH and just loaded a web page from Apache. We can then see that the connections to Apache quickly change to time-wait.
[root@centos7 ~]# ss -t state established Recv-Q Send-Q Local Address:Port Peer Address:Port 0 64 192.168.1.14:ssh 192.168.1.191:57091 0 0 ::ffff:192.168.1.14:http ::ffff:192.168.1.191:57373 0 0 ::ffff:192.168.1.14:http ::ffff:192.168.1.191:57372 [root@centos7 ~]# ss -t state time-wait Recv-Q Send-Q Local Address:Port Peer Address:Port 0 0 ::ffff:192.168.1.14:http ::ffff:192.168.1.191:57373 0 0 ::ffff:192.168.1.14:http ::ffff:192.168.1.191:57372
-
16. Filter Based On Port Number
Filtering can also be performed to list all ports that are less than (lt), greater than (gt), equal to (eq), not equal to (ne), less than or equal to (le), or greater than or equal to (ge).
For example, the below command shows all listening ports on port number 500 or below.
[root@centos7 ~]# ss -ltn sport le 500 State Recv-Q Send-Q Local Address:Port Peer Address:Port LISTEN 0 128 *:111 *:* LISTEN 0 5 192.168.122.1:53 *:* LISTEN 0 128 *:22 *:* LISTEN 0 100 127.0.0.1:25 *:* LISTEN 0 128 :::111 :::* LISTEN 0 128 :::22 :::* LISTEN 0 100 ::1:25 :::*
For comparison we can perform the opposite, and view all ports greater than 500 with ‘gt’
[root@centos7 ~]# ss -ltn sport gt 500 State Recv-Q Send-Q Local Address:Port Peer Address:Port LISTEN 0 128 127.0.0.1:631 *:* LISTEN 0 128 ::1:631 :::*
We can also filter based on items such as source or destination port, for example below we search for TCP sockets that have a source port (sport) of ssh.
[root@centos7 ~]# ss -t '( sport = :ssh )' State Recv-Q Send-Q Local Address:Port Peer Address:Port ESTAB 0 64 192.168.1.14:ssh 192.168.1.191:57091
-
17. Show SELinux Context
The -Z and -z options can be used to show the SELinux security context of a socket. In the example below we also use the -t and -l options to only list listening TCP sockets, with the -Z option we can also see the SELinux contexts.
[root@centos7 ~]# ss -tlZ State Recv-Q Send-Q Local Address:Port Peer Address:Port LISTEN 0 128 *:sunrpc *:* users:(("systemd",pid=1,proc_ctx=system_u:system_r:init_t:s0,fd=71)) LISTEN 0 5 192.168.122.1:domain *:* users:(("dnsmasq",pid=1810,proc_ctx=system_u:system_r:dnsmasq_t:s0-s0:c0.c1023,fd=6)) LISTEN 0 128 *:ssh *:* users:(("sshd",pid=1173,proc_ctx=system_u:system_r:sshd_t:s0-s0:c0.c1023,fd=3)) LISTEN 0 128 127.0.0.1:ipp *:* users:(("cupsd",pid=1145,proc_ctx=system_u:system_r:cupsd_t:s0-s0:c0.c1023,fd=12)) LISTEN 0 100 127.0.0.1:smtp *:* users:(("master",pid=1752,proc_ctx=system_u:system_r:postfix_master_t:s0,fd=13)) -
18. Display Version
The -v option can be used to display specific version information for the ss command, in this instance we see the version of the iproute package which provides ss.
[root@centos7 ~]# ss -v ss utility, iproute2-ss130716
-
19. Print Help Documentation
The -h option can be used to display further help regarding the ss command, it’s good to use as a quick reference if you need a short description on some of the most commonly used options. Note that the full output here has not been included for brevity.
[root@centos7 ~]# ss -h Usage: ss [ OPTIONS ]
-
20. Show Extended Information
We can use the -e option which shows extended detailed information, as shown below we can see the extended information appended to the end of each line.
[root@centos7 ~]# ss -lte State Recv-Q Send-Q Local Address:Port Peer Address:Port LISTEN 0 128 *:sunrpc *:* ino:16090 sk:ffff880000100000 <-> LISTEN 0 5 192.168.122.1:domain *:* ino:23750 sk:ffff880073e70f80 <-> LISTEN 0 128 *:ssh *:* ino:22789 sk:ffff880073e70000 <-> LISTEN 0 128 127.0.0.1:ipp *:* ino:23091 sk:ffff880073e707c0 <-> LISTEN 0 100 127.0.0.1:smtp *:* ino:24659 sk:ffff880000100f80 <->
-
21. Show Timer Information
The -o option can be used to display the timer information. This information shows us things such as the retransmission timer value, number of retransmissions that have occurred, and the number of keepalive probes that have been sent.
[root@centos7 ~]# ss -to State Recv-Q Send-Q Local Address:Port Peer Address:Port ESTAB 0 64 192.168.1.14:ssh 192.168.1.191:57091 timer:(on,242ms,0) ESTAB 0 0 ::ffff:192.168.1.14:http ::ffff:192.168.1.191:57295 timer:(keepalive,120min,0) ESTAB 0 0 ::ffff:192.168.1.14:http ::ffff:192.168.1.191:57296 timer:(keepalive,120min,0)