Socket Statistics on Linux

Small follow up of my former article on iproute2, in this article we’ll see some use of the command ss to know more information about Linux TCP / UDP Network and Socket Information

ss command is included in iproute2 package and is the substitute of the command netstat.

ss is used to dump socket statistics. It allows showing information similar to netstat. It can display more TCP and state informations than other tools.

The more common options for ss are (from the man):

       -n, --numeric
              Do now try to resolve service names.

       -r, --resolve
              Try to resolve numeric address/ports.

       -a, --all
              Display all sockets.

       -l, --listening
              Display listening sockets.

       -o, --options
              Show timer information.

       -e, --extended
              Show detailed socket information

       -m, --memory
              Show socket memory usage.

       -p, --processes
              Show process using socket.

       -i, --info
              Show internal TCP information.

       -s, --summary
              Print  summary  statistics.  This  option  does not parse socket
              lists obtaining summary from various sources. It is useful  when
              amount  of  sockets  is  so  huge  that parsing /proc/net/tcp is
              painful.


And now some practical use of the command ss:

1) ss -l
Show all listening sockets

2) ss -o state established '( dport = :ssh or sport = :ssh )'

Display all established ssh connections.

3) ss -ant | awk '{print $NF}' | grep -v '[a-z]' | sort | uniq -c

List the number and type of active network connections

4) ss -x src /tmp/.X11-unix/*
Find all local processes connected to X server.

5) ss -s
Print a summary of socket status

6) ss -tlnp
Lists all listening ports together with the PID of the associated process
The PID will only be printed if you’re holding a root equivalent ID.

For more information check the official page

Popular Posts:

None Found