Was ersetzt netstat in Ubuntu? Der Befehl ` ss` ersetzt `netstat`. Der Befehl `ip route` ersetzt `netstat -r`. Der Befehl `ip link` ersetzt `netstat -i`. ss -l display all open network ports with ss command on Linux Type the following to see process named using open socket: ss -pl Find out who is responsible for opening socket / port # 4949 using the ss command and grep command: ss -lp | grep 4949 Display All TCP Sockets ss -t -a Display All UDP Sockets ss -u -a Display All UNIX Sockets ss -x -a Display All Established SMTP Connections ss -o state established '( dport = :smtp or sport = :smtp )' Display All Established HTTP Connections ss -o state established '( dport = :http or sport = :http )' Find All Local Processes Connected To X Server ss -x src /tmp/.X11-unix/* List All The Tcp Sockets in State FIN-WAIT-1 List all the TCP sockets in state -FIN-WAIT-1 for our httpd to network 202.54.1/24 and look at their timers: ss -o state fin-wait-1 '( sport = :http or sport = :https )' dst 202.54.1/24 How Do I Filter Sockets Using TCP States? The syntax is as follows: ## tcp ipv4 ## ss -4 state FILTER-NAME-HERE ## tcp ipv6 ## ss -6 state FILTER-NAME-HERE Where FILTER-NAME-HERE can be any one of the following, established syn-sent syn-recv fin-wait-1 fin-wait-2 time-wait closed close-wait last-ack listen closing all : All of the above states connected : All the states except for listen and closed synchronized : All the connected states except for syn-sent bucket : Show states, which are maintained as minisockets, i.e. time-wait and syn-recv. big : Opposite to bucket state. ss command examples Type the following command to see closing sockets: ss -4 state closing Outputs: Recv-Q Send-Q Local Address:Port Peer Address:Port 1 11094 75.126.153.214:http 175.44.24.85:4669 How Do I Matches Remote Address And Port Numbers? Use the following syntax: ss dst ADDRESS_PATTERN ## Show all ports connected from remote 192.168.1.5## ss dst 192.168.1.5 ## show all ports connected from remote 192.168.1.5:http port## ss dst 192.168.1.5:http ss dst 192.168.1.5:smtp ss dst 192.168.1.5:443 Find out connection made by remote 123.1.2.100:http to our local virtual servers: ss dst 123.1.2.100:http Sample outputs: State Recv-Q Send-Q Local Address:Port Peer Address:Port ESTAB 0 0 75.126.153.206:http 123.1.2.100:35710 ESTAB 0 0 75.126.153.206:http 123.1.2.100:35758 How Do I Matches Local Address And Port Numbers Using the ss command? The syntax is as follows for the ss command: ss src ADDRESS_PATTERN ### find out all ips connected to nixcraft.com ip address 75.126.153.214 ### ## Show all ports connected to local 75.126.153.214## ss src 75.126.153.214 ## http (80) port only ## ss src 75.126.153.214:http ss src 75.126.153.214:80 ## smtp (25) port only ## ss src 75.126.153.214:smtp ss src 75.126.153.214:25 How Do I Compare Local and/or Remote Port To A Number Using the ss command? Use the following syntax: ## Compares remote port to a number ## ss dport OP PORT ## Compares local port to a number ## sport OP PORT Where OP can be one of the following: <= or le : Less than or equal to port >= or ge : Greater than or equal to port == or eq : Equal to port != or ne : Not equal to port < or gt : Less than to port > or lt : Greater than to port Note: le, gt, eq, ne etc. are use in unix shell and are accepted as well. Examples ################################################################################### ### Do not forget to escape special characters when typing them in command line ### ################################################################################### ss sport = :http ss dport = :http ss dport \> :1024 ss sport \> :1024 ss sport \< :32000 ss sport eq :22 ss dport != :22 ss state connected sport = :http ss \( sport = :http or sport = :https \) ss -o state fin-wait-1 \( sport = :http or sport = :https \) dst 192.168.1/24 ss command options summery Usage: ss [ OPTIONS ] ss [ OPTIONS ] [ FILTER ] -h, --help this message -V, --version output version information -n, --numeric don't resolve service names -r, --resolve resolve host names -a, --all display all sockets -l, --listening display listening sockets -o, --options show timer information -e, --extended show detailed socket information -m, --memory show socket memory usage -p, --processes show process using socket -i, --info show internal TCP information --tipcinfo show internal tipc socket information -s, --summary show socket usage summary --tos show tos and priority information -b, --bpf show bpf filter socket information -E, --events continually display sockets as they are destroyed -Z, --context display process SELinux security contexts -z, --contexts display process and socket SELinux security contexts -N, --net switch to the specified network namespace name -4, --ipv4 display only IP version 4 sockets -6, --ipv6 display only IP version 6 sockets -0, --packet display PACKET sockets -t, --tcp display only TCP sockets -S, --sctp display only SCTP sockets -u, --udp display only UDP sockets -d, --dccp display only DCCP sockets -w, --raw display only RAW sockets -x, --unix display only Unix domain sockets --tipc display only TIPC sockets --vsock display only vsock sockets -f, --family=FAMILY display sockets of type FAMILY FAMILY := {inet|inet6|link|unix|netlink|vsock|tipc|xdp|help} -K, --kill forcibly close sockets, display what was closed -H, --no-header Suppress header line -O, --oneline socket's data printed on a single line -A, --query=QUERY, --socket=QUERY QUERY := {all|inet|tcp|udp|raw|unix|unix_dgram|unix_stream|unix_seqpacket|packet|netlink|vsock_stream|vsock_dgram|tipc}[,QUERY] -D, --diag=FILE Dump raw information about TCP sockets to FILE -F, --filter=FILE read filter information from FILE FILTER := [ state STATE-FILTER ] [ EXPRESSION ] STATE-FILTER := {all|connected|synchronized|bucket|big|TCP-STATES} TCP-STATES := {established|syn-sent|syn-recv|fin-wait-{1,2}|time-wait|closed|close-wait|last-ack|listening|closing} connected := {established|syn-sent|syn-recv|fin-wait-{1,2}|time-wait|close-wait|last-ack|closing} synchronized := {established|syn-recv|fin-wait-{1,2}|time-wait|close-wait|last-ack|closing} bucket := {syn-recv|time-wait} big := {established|syn-sent|fin-wait-{1,2}|closed|close-wait|last-ack|listening|closing} Comparing the ss vs netstat command speed Use the time command to run both programs and summarize system resource usage. Type the netstat command as follows: time netstat -at Sample outputs: real 2m52.254s user 0m0.178s sys 0m0.170s Now, try the ss command: time ss -atr Sample outputs: real 2m11.102s user 0m0.124s sys 0m0.068s Note: Both outputs are taken from reverse proxy acceleration server running on RHEL v6.x amd64. For more info see ss command man page by typing the following man command or help command: man ss See https://wiki.linuxfoundation.org/networking/iproute2 for info on the ss and iproute2.