[Linux] server网络监控利器ss

showerlee — Thu, 26 Nov 2015 07:57:40 +0000

大家之前都比较常用netstat命令去获取本地server的一些连接信息, 或者利用该命令去编写一些脚本, 这个命令的优点在于已经基本上集成到windows, linux各个发行版内, 算是一个比较老牌的命令. 但对于日新月异的系统更新升级, 他对于高并发连接的系统往往会显露出执行效率缓慢的弊端.

今天给大家要介绍一个笔者最近才接触到的命令ss, 这个命令其实并不冷门, 基本在ubuntu, centos的minimal安装模式下系统都会将ss集成到kernel系统内, 这个命令的优点在于比netstat返回的信息更加简单直观, 语法简洁实用, 而且执行效率更高.

以下就给大家介绍利用ss的一些常用语法去检查本地网络连接状态.

1. 列出所有连接(tcp, udp, unix socket)

$ ss | less
Netid  State      Recv-Q Send-Q   Local Address: Port       Peer Address: Port   
u_str  ESTAB      0      0                    * 15545                 * 15544  
u_str  ESTAB      0      0                    * 12240                 * 12241  
u_str  ESTAB      0      0      @/tmp/dbus-2hQdRvvg49 12726                 * 12159  
u_str  ESTAB      0      0                    * 11808                 * 11256  
u_str  ESTAB      0      0                    * 15204                 * 15205  
.....

2. 分别过滤出tcp, udp, unix连接

1). tcp连接

$ ss -t
State      Recv-Q Send-Q    Local Address:Port        Peer Address:Port   
ESTAB      0      0           192.168.1.2:43839     108.160.162.37:http    
ESTAB      0      0           192.168.1.2:43622     199.59.149.201:https   
ESTAB      0      0           192.168.1.2:33141      83.170.73.249:ircd    
ESTAB      0      0           192.168.1.2:54028     74.125.135.125:xmpp-client

默认 -t 用来显示"establish"或者"connected", 如果要显示"Listening"状态的信息需使用 -at 参数

2). udp连接

$ ss -ua
State      Recv-Q Send-Q    Local Address:Port        Peer Address:Port   
UNCONN     0      0           192.168.1.2:48268                  *:*       
UNCONN     0      0           192.168.1.2:56575                  *:*       
UNCONN     0      0                     *:40309                  *:*       
UNCONN     0      0           192.168.1.2:56879                  *:*       
UNCONN     0      0                     *:49014                  *:*       
UNCONN     0      0           192.168.1.2:53124                  *:*       
UNCONN     0      0             127.0.1.1:domain                 *:*

3). unix连接

$ ss -x
Netid State      Recv-Q Send-Q          Local Address:Port              Peer Address:Port   
u_str ESTAB      0      0                           * 10415                        * 0      
u_str ESTAB      0      0                           * 10416                        * 0      
u_str ESTAB      0      0                           * 10420                        * 0  
...

3. 不解析域名连接

$ ss -nt
State      Recv-Q Send-Q      Local Address:Port        Peer Address:Port 
ESTAB      0      0             192.168.1.2:43839     108.160.162.37:80    
ESTAB      0      0             192.168.1.2:51350      74.125.200.84:443   
ESTAB      0      0             192.168.1.2:33141      83.170.73.249:6667  
ESTAB      0      0             192.168.1.2:54028     74.125.135.125:5222  
ESTAB      0      0             192.168.1.2:48156      66.196.120.44:5050

4. 显示"Listening" tcp socket 非主机名连接

$ ss -ltn
State      Recv-Q Send-Q        Local Address:Port          Peer Address:Port 
LISTEN     0      5                 127.0.1.1:53                       *:*     
LISTEN     0      128               127.0.0.1:631                      *:*     
LISTEN     0      128                     ::1:631                     :::*

若要显示utp连接则将t修改成u

5. 显示进程name和id

$ ss -ltp
State      Recv-Q Send-Q    Local Address:Port        Peer Address:Port   
LISTEN     0      100           127.0.0.1:smtp                   *:*       
LISTEN     0      128           127.0.0.1:9050                   *:*       
LISTEN     0      128                   *:90                     *:*       
LISTEN     0      128                   *:db-lsp                 *:*        users:(("dropbox",3566,32))
LISTEN     0      5             127.0.0.1:6600                   *:*       
LISTEN     0      128           127.0.0.1:9000                   *:*        users:(("php5-fpm",1620,0),("php5-fpm",1619,0))

6. 获取统计信息

$ ss -s
Total: 526 (kernel 0)
TCP:   10 (estab 7, closed 0, orphaned 0, synrecv 0, timewait 0/0), ports 0

Transport Total     IP        IPv6
*	  0         -         -        
RAW	  0         0         0        
UDP	  15        9         6        
TCP	  10        9         1        
INET	  25        18        7        
FRAG	  0         0         0

7. 获取时间信息

$ ss -tn -o
State      Recv-Q Send-Q      Local Address:Port        Peer Address:Port 
ESTAB      0      0             192.168.1.2:43839     108.160.162.37:80    
ESTAB      0      0             192.168.1.2:36335     204.144.140.26:80     timer:(keepalive,26sec,0)
ESTAB      0      0             192.168.1.2:33141      83.170.73.249:6667  
ESTAB      0      0             192.168.1.2:58857      74.121.141.84:80     timer:(keepalive,23sec,0)
ESTAB      0      0             192.168.1.2:42794     173.194.40.239:80     timer:(keepalive,32sec,0)

8. 显示ipv4或者v6的连接

$ ss -tl -f inet
State      Recv-Q Send-Q    Local Address:Port        Peer Address:Port   
LISTEN     0      100           127.0.0.1:smtp                   *:*       
LISTEN     0      128           127.0.0.1:9050                   *:*       
LISTEN     0      128                   *:90                     *:*       
LISTEN     0      128                   *:db-lsp                 *:*       
LISTEN     0      5             127.0.0.1:6600                   *:*

$ ss -tl6
State      Recv-Q Send-Q    Local Address:Port        Peer Address:Port   
LISTEN     0      100                 ::1:smtp                  :::*       
LISTEN     0      128                  :::12865                 :::*       
LISTEN     0      128                  :::http                  :::*       
LISTEN     0      128                  :::ssh                   :::*       
LISTEN     0      128                 ::1:ipp                   :::*

9. 过滤tcp状态连接.

ss命令的好处在于可以过滤具体条件的连接, 常用的信息可以不需要额外利用管道符配合.

他的语法格式:

# ss [条件] [状态过滤] [地址过滤]

1). 显示所有ipv4 tcp connected状态的连接

$ ss -t4 state established
Recv-Q Send-Q         Local Address:Port             Peer Address:Port   
0      0                192.168.1.2:54436          165.193.246.23:https   
0      0                192.168.1.2:43386          173.194.72.125:xmpp-client 
0      0                192.168.1.2:38355           199.59.150.46:https   
0      0                192.168.1.2:56198          108.160.162.37:http

2). 显示所有ipv4 tcp time-wait状态的连接

$ ss -t4 state time-wait
Recv-Q Send-Q         Local Address:Port             Peer Address:Port   
0      0                192.168.1.2:42261           199.59.150.39:https   
0      0                  127.0.0.1:43541               127.0.0.1:2633

以下是其他可用的状态

 1. established
 2. syn-sent
 3. syn-recv
 4. fin-wait-1
 5. fin-wait-2
 6. time-wait
 7. closed
 8. close-wait 
 9. last-ack
 10. closing
 11. all - All of the above states
 12. connected - All the states except for listen and closed
 13. synchronized - All the connected states except for syn-sent
 14. bucket - Show states, which are maintained as minisockets, i.e. time-wait and syn-recv.
 15. big - Opposite to bucket state.

10. 通过地址和端口号过滤

除了socket过滤, ss也支持基于地址和端口号的过滤格式.

1). 显示所有源地址和目的地址都为ssh端口的socket连接.

$ ss -at '( dport = :ssh or sport = :ssh )'
State      Recv-Q Send-Q    Local Address:Port        Peer Address:Port   
LISTEN     0      128                   *:ssh                    *:*       
LISTEN     0      128                  :::ssh                   :::*

2). 目的端口为443或80的所有socket连接.

$ ss -nt '( dst :443 or dst :80 )'
State      Recv-Q Send-Q      Local Address:Port        Peer Address:Port 
ESTAB      0      0             192.168.1.2:58844      199.59.148.82:443   
ESTAB      0      0             192.168.1.2:55320     165.193.246.23:443   
ESTAB      0      0             192.168.1.2:56198     108.160.162.37:80    
ESTAB      0      0             192.168.1.2:54889    192.241.177.148:443   
ESTAB      0      0             192.168.1.2:39893      173.255.230.5:80    
ESTAB      0      0             192.168.1.2:33440      38.127.167.38:443

或者可以这么简写

$ ss -nt dst :443 or dst :80

更多例子:

# 通过地址过滤
$ ss -nt dst 74.125.236.178

# 简写子网过滤
$ ss -nt dst 74.125.236.178/16

# 地址和端口过滤
$ ss -nt dst 74.125.236.178:80

# 目的端口过滤
$ ss -nt dport = :80
State      Recv-Q Send-Q      Local Address:Port        Peer Address:Port 
ESTAB      0      0             192.168.1.2:56198     108.160.162.37:80    
ESTAB      0      0             192.168.1.2:39893      173.255.230.5:80    
ESTAB      0      0             192.168.1.2:55043     74.125.236.178:80

# 源地址为127.0.0.1且源端口大于5000的TCP连接
$ ss -nt src 127.0.0.1 sport gt :5000

# 本地smtp (port 25) socket连接
$ ss -ntlp sport eq :smtp

# 端口大于25的连接
$ ss -nt sport gt :25

# 目的地址端口小于100的连接
$ ss -nt dport \< :100

# 连接到远程80端口的连接
$ sudo ss -nt state connected dport = :80

总结

以上所有的例子基本上涵盖了所有ss的常用支持, 更多介绍可以使用man查看他的官方文档

声明: 本文采用 CC BY-NC-SA 3.0 协议进行授权

转载请注明来源：DevOps技术分享

本文链接地址：http://www.showerlee.com/archives/1741

DevOps技术分享 » ss

[Linux] server网络监控利器ss