linux下ss命令的使用方法介绍

ss是Socket Statistics的缩写。顾名思义,ss命令可以用来获取socket统计信息,它可以显示和netstat类似的内容。ss的优势在于它能够显示更多更详细的有关TCP和连接状态的信息,而且比netstat更快速更高效。

当服务器的socket连接数量变得非常大时,无论是使用netstat命令还是直接cat /proc/net/tcp,执行速度都会很慢。

ss快的秘诀在于,它利用到了TCP协议栈中tcp_diag,tcp_diag是一个用于分析统计的模块,可以获得Linux 内核中第一手的信息,这就确保了ss的快捷高效

ss命令常见的参数

Usage: ss [ OPTIONS ]
       ss [ OPTIONS ] [ FILTER ]
   -h, --help           this message
   -V, --version        output version information
   -n, --numeric        don't resolve service names
   -r, --resolve       resolve host names
   -a, --all            display all sockets
   -l, --listening      display listening socket
   -o, --options       show timer information
   -e, --extended      show detailed socket information
   -m, --memory        show socket memory usage
   -p, --processes      show process using socket
   -i, --info           show internal TCP information
   -s, --summary        show socket usage summary
   -4, --ipv4          display only IP version 4 sockets
   -6, --ipv6          display only IP version 6 sockets
   -0, --packet display PACKET sockets
   -t, --tcp            display only TCP sockets
   -u, --udp            display only UDP sockets
   -d, --dccp           display only DCCP sockets
   -w, --raw            display only RAW sockets
   -x, --unix           display only Unix domain sockets
   -f, --family=FAMILY display sockets of type FAMILY
   -A, --query=QUERY, --socket=QUERY
       QUERY := {all|inet|tcp|udp|raw|unix|packet|netlink}[,QUERY]
   -D, --diag=FILE      Dump raw information about TCP sockets to FILE
   -F, --filter=FILE   read filter information from FILE
       FILTER := [ state TCP-STATE ] [ EXPRESSION ]

查看打开的所有网络端口

#ss -l
State       Recv-Q Send-Q                                 Local Address:Port                                     Peer Address:Port   
LISTEN      0      100                                        127.0.0.1:smtp                                                *:*       
LISTEN      0      128                                                *:https                                               *:*       
LISTEN      0      128                                                *:zabbix-agent                                             *:*       
LISTEN      0      128                                        127.0.0.1:smux                                                *:*       
LISTEN      0      128                                        127.0.0.1:cslistener                                             *:*       
LISTEN      0      50                                                 *:mysql                                               *:*       
LISTEN      0      128                                                *:http                                                *:*       
LISTEN      0      128                                                *:42194                                               *:*       
LISTEN      0      128                                                *:ssh                                                 *:*

如果是需要显示具体进程名称需要添加-p参数

#ss -pl
State       Recv-Q Send-Q                                 Local Address:Port                                     Peer Address:Port   
LISTEN      0      100                                        127.0.0.1:smtp                                                *:*        users:(("master",1855,12))
LISTEN      0      128                                                *:https                                               *:*        users:(("nginx",16811,7),("nginx",16813,7))
LISTEN      0      128                                                *:zabbix-agent                                             *:*        users:(("zabbix_agentd",21229,4),("zabbix_agentd",21234,4),("zabbix_agentd",21235,4),("zabbix_agentd",21236,4),("zabbix_agentd",21237,4),("zabbix_agentd",21238,4))
LISTEN      0      128                                        127.0.0.1:smux                                                *:*        users:(("snmpd",21282,9))
LISTEN      0      128                                        127.0.0.1:cslistener                                             *:*        users:(("php-fpm",700,0),("php-fpm",701,0),("php-fpm",702,0),("php-fpm",703,0),("php-fpm",10177,0),("php-fpm",17708,0),("php-fpm",21001,7),("php-fpm",25101,0),("php-fpm",27617,0))
LISTEN      0      50                                                 *:mysql                                               *:*        users:(("mysqld",23273,13))
LISTEN      0      128                                                *:http                                                *:*        users:(("nginx",16811,6),("nginx",16813,6))
LISTEN      0      128                                                *:42194                                               *:*        users:(("pwhmze",11851,7))
LISTEN      0      128                                                *:ssh                                                 *:*

这样可以看到相关进程的进程号,可以方便后续对进程的操作处理

查看所有的socket连接

#ss -a
State       Recv-Q Send-Q                                 Local Address:Port                                     Peer Address:Port   
LISTEN      0      100                                        127.0.0.1:smtp                                                *:*       
LISTEN      0      128                                                *:https                                               *:*       
LISTEN      0      128                                                *:zabbix-agent                                             *:*       
LISTEN      0      128                                        127.0.0.1:smux                                                *:*       
LISTEN      0      128                                        127.0.0.1:cslistener                                             *:*       
LISTEN      0      50                                                 *:mysql                                               *:*       
LISTEN      0      128                                                *:http                                                *:*       
LISTEN      0      128                                                *:42194                                               *:*       
LISTEN      0      128                                                *:ssh                                                 *:*       
TIME-WAIT   0      0                                      172.31.108.54:60116                                   47.35.240.212:EtherNet/IP-1 
ESTAB       0      0                                      172.31.108.54:43818                                   47.93.148.247:22222   
TIME-WAIT   0      0                                      172.31.108.54:60238                                   47.35.240.212:EtherNet/IP-1 
ESTAB       0      0                                      172.31.108.54:https                                   49.233.176.23:37586   
SYN-SENT    0      1                                      172.31.108.54:34000                                     47.66.70.77:EtherNet/IP-1 
SYN-SENT    0      1                                      172.31.108.54:40610                                   47.204.220.61:ssh     
SYN-SENT    0      1                                      172.31.108.54:44480                                   47.175.248.61:tr-rsrb-p1 
SYN-SENT    0      1                                      172.31.108.54:45160                                    47.140.9.186:22222   
TIME-WAIT   0      0                                      172.31.108.54:60044                                   47.35.240.212:EtherNet/IP-1 
SYN-SENT    0      1                                      172.31.108.54:56004                                   47.237.174.38:EtherNet/IP-1 
ESTAB       0      0                                      172.31.108.54:37406                                  47.100.166.197:22222   
SYN-SENT    0      1                                      172.31.108.54:33762                                    47.27.31.120:22222   
SYN-SENT    0      1                                      172.31.108.54:52104                                   47.247.97.112:22222   
SYN-SENT    0      1                                      172.31.108.54:32822                                  47.223.135.180:22222   
......

如果只想查看TCP sockets,那么使用-ta选项

如果只想查看UDP sockets,那么使用-ua选项

如果只想查看RAW sockets,那么使用-wa选项

如果只想查看UNIX sockets,那么使用-xa选项

显示所有状态为established的SMTP连接

#ss -o state 'established'
Recv-Q Send-Q                                      Local Address:Port                                          Peer Address:Port   
0      12                                          172.31.108.54:33912                                        47.35.240.212:EtherNet/IP-1  timer:(on,2.994ms,0)
0      0                                           172.31.108.54:43818                                        47.93.148.247:22222    timer:(keepalive,8.994ms,0)
0      0                                           172.31.108.54:37406                                       47.100.166.197:22222    timer:(keepalive,10sec,0)
0      0                                           172.31.108.54:33700                                         47.106.88.88:22222    timer:(keepalive,2.177ms,0)
0      0                                           172.31.108.54:59984                                         161.35.21.73:https    timer:(keepalive,57sec,0)
0      0                                           172.31.108.54:36556                                        111.229.66.87:35356    timer:(keepalive,7.994ms,0)
0      0                                           172.31.108.54:36284                                        106.54.102.94:40716    timer:(keepalive,10sec,0)
0      0                                           172.31.108.54:49156                                         47.105.80.90:22222    timer:(keepalive,8.994ms,0)
0      96                                          172.31.108.54:ssh                                            103.59.50.2:52820    timer:(on,1.331ms,0)
0      0                                           172.31.108.54:45020                                       111.28.140.171:44756    timer:(keepalive,4.994ms,0)
0      0                                           172.31.108.54:56186                                        49.235.57.113:40006    timer:(keepalive,089ms,1)
0      0                                           172.31.108.54:57742                                       111.229.255.31:39242    timer:(keepalive,8.994ms,0)
0      0                                           172.31.108.54:55686                                       47.102.121.167:22222    timer:(keepalive,074ms,0)
0      0                                           172.31.108.54:33792                                         47.93.91.161:22222    timer:(keepalive,8.091ms,0)
0      0                                           172.31.108.54:49074                                       139.155.46.100:35079    timer:(keepalive,3.994ms,0)

匹配远程地址和端口号

ss dst 172.31.108.54
ss dst 172.31.108.54:12222

匹配本地地址和端口号

ss src 172.31.108.54
ss src 172.31.108.54:22


内容版权声明:除非注明,否则皆为本站原创文章。

转载注明出处:https://sulao.cn/post/768.html