还在用netstat命令嘛？比netstat好用的ss命令了解下

大侠之运维 2022-07-18

2452

点击上方蓝字关注大侠之运维

初入职场的运维，了解当前的网络状态情况，很多都会用到netstat这个命令，在很长的一段时间里，这个命令也是排查问题的利器。ss命令与netstat类似，但是ss命令效率更高，信息展示的更全。

两个命令的最根本区别在于netstat是去/proc下遍历PID的信息，但是ss则是直接去/proc/net下读取统计好的信息。

本文整理了关于ss的一些用法，如果还有其它没有提到的选项需要了解，可以执行ss -h 查看帮助。

♦️

实际用法

ss可以查看PACKET sockets，TCP sockets，UDP sockets，DCCP sockets，RAW sockets，Unix domain sockets等socket连接信息

如果要查看各类socket连接整体的一个统计信息的话，可以使用 -s的选项，可以测试看下结果。

[root@sc-01 ~]# ss -s
Total: 783 (kernel 1033)
TCP:   458 (estab 123, closed 319, orphaned 0, synrecv 0, timewait 56/0), ports 0


Transport Total     IP        IPv6
*    1033      -         -        
RAW    0         0         0        
UDP    3         2         1        
TCP    139       118       21       
INET    142       120       22       
FRAG    0         0         0

我们最常了解的就是TCP和INET了，前者是网络连接中最长用到的协议之一，后者包含了ipv6和ipv4请求和，可以通过 -4a、-6a分别查看。

上述命令可以让我们了解网络连接的一个大致的情况，如果要分别查看不同链接的具体情况，可以通过指定不同的连接参数，如查看TCP连接，可以指定-t来查看。

在执行查看前，可以先确认下链接条数，然后再去查看。

[root@sc-01 ~]# ss -t|wc -l
124
[root@sc-01 ~]# ss -t|more
State      Recv-Q Send-Q Local Address:Port                 Peer Address:Port                
ESTAB      0      0      192.168.20.6:42990                192.168.200.28:XmlIpcRegSvc         
ESTAB      0      0      192.168.20.6:51164                10.100.1.51:jetdirect            
ESTAB      0      0      192.168.20.6:51184                10.100.1.42:jetdirect            
ESTAB      0      0      192.168.20.6:43620                192.168.61.14:jetdirect            
ESTAB      0      0      192.168.20.6:60510                192.168.10.17:jetdirect

这个命令另外一个用到比较多的场景就是对本机开启的监听端口的查看，可以通过 ss -ltn来查看，注意加n可以显示具体的端口号，不加的话显示的是服务名。

可以看下效果：

[root@sc-01 ~]# ss -ltn
State       Recv-Q Send-Q                                                           Local Address:Port                                                                          Peer Address:Port              
LISTEN      0      128                                                                          *:501                                                                                     *:*                  
LISTEN      0      128                                                                  127.0.0.1:10573                                                                                    *:*                  
LISTEN      0      5                                                                            *:2198                                                                                     *:*                  
LISTEN      0      128                                                                          *:29022                                                                                    *:*                  
LISTEN      0      128                                                                       [::]:9090                                                                                  [::]:*                  
LISTEN      0      128                                                                       [::]:33060                                                                                 [::]:*                  
LISTEN      0      128                                                                       [::]:33061                                                                                 [::]:*                  
LISTEN      0      128                                                                       [::]:11111                                                                                 [::]:*                  
LISTEN      0      128                                                                       [::]:9100                                                                                  [::]:*                  
LISTEN      0      50                                                      [::ffff:192.168.20.6]:9997                                                                                  [::]:*                  
LISTEN      0      128                                                                       [::]:222                                                                                  [::]:*                  
LISTEN      0      128                                                                       [::]:63790                                                                                 [::]:*                  
LISTEN      0      100                                                                       [::]:8080                                                                                  [::]:*                  
LISTEN      0      128                                                                       [::]:80                                                                                    [::]:*                  
LISTEN      0      5                                                                         [::]:2198                                                                                  [::]:*                  
LISTEN      0      128                                                                       [::]:22                                                                                 [::]:*

如果要统计服务器目前的并发数的话，可以通过如下命令来查看

state可以过滤一些参数来查看具体信息

[root@sc-01 ~]# ss -o state established |wc -l
170

上述state可以过滤的一些状态包括：

established|syn-sent|syn-recv|fin-wait-{1,2}|time-wait|closed|close-wait|last-ack|listen|closing

另外ss也可以通过对ip来进行筛选，还可以对具体的来源端口sport、目标端口进行一定的过滤。

ss src ADDRESS_PATTERN 
[root@sc-01 ~]# ss src 192.168.20.6:39778
Netid State      Recv-Q Send-Q                                                       Local Address:Port                                                                        Peer Address:Port                
tcp   ESTAB      0      0                                                            192.168.20.6:39778                                                                       192.168.4.5:jetdirect

ss dport OP PORT


[root@sc-01 ~]# ss \( sport \> 54000 and sport \< 59000 \) 
Netid State      Recv-Q Send-Q                                                       Local Address:Port                                                                        Peer Address:Port                
u_str ESTAB      0      0                                                                        * 54216                                                                                  * 53098                
u_str ESTAB      0      0                                                                        * 54208                                                                                  * 53078                
tcp   ESTAB      0      0                                                            192.168.20.6:58878                                                                       192.168.5.9:jetdirect            
tcp   ESTAB      0      0                                                            192.168.20.6:57278                                                                      192.168.1.23:jetdirect            
tcp   ESTAB      0      0                                                            192.168.20.6:54830                                                                      192.168.6.18:jetdirect            
tcp   ESTAB      0      0                                                            192.168.20.6:55284                                                                      192.168.1.18:jetdirect            
tcp   ESTAB      0      0                                                            192.168.20.6:54516                                                                        10.100.1.1:jetdirect            
tcp   ESTAB      0      0                                                            192.168.20.6:54832                                                                      192.168.6.23:jetdirect            
tcp   ESTAB      0      0                                                            192.168.20.6:57190                                                                       192.168.5.8:jetdirect

最后附上ss -h的帮助页：

[root@sc-01 ~]# ss -h
Usage: ss [ OPTIONS ]
       ss [ OPTIONS ] [ FILTER ]
   -h, --help          this message
   -V, --version       output version information
   -n, --numeric       don't resolve service names
   -r, --resolve       resolve host names
   -a, --all           display all sockets
   -l, --listening     display listening sockets
   -o, --options       show timer information
   -e, --extended      show detailed socket information
   -m, --memory        show socket memory usage
   -p, --processes     show process using socket
   -i, --info          show internal TCP information
   -s, --summary       show socket usage summary
   -b, --bpf           show bpf filter socket information
   -E, --events        continually display sockets as they are destroyed
   -Z, --context       display process SELinux security contexts
   -z, --contexts      display process and socket SELinux security contexts
   -N, --net           switch to the specified network namespace name


   -4, --ipv4          display only IP version 4 sockets
   -6, --ipv6          display only IP version 6 sockets
   -0, --packet        display PACKET sockets
   -t, --tcp           display only TCP sockets
   -S, --sctp          display only SCTP sockets
   -u, --udp           display only UDP sockets
   -d, --dccp          display only DCCP sockets
   -w, --raw           display only RAW sockets
   -x, --unix          display only Unix domain sockets
       --vsock         display only vsock sockets
   -f, --family=FAMILY display sockets of type FAMILY
       FAMILY := {inet|inet6|link|unix|netlink|vsock|help}


   -K, --kill          forcibly close sockets, display what was closed
   -H, --no-header     Suppress header line


   -A, --query=QUERY, --socket=QUERY
       QUERY := {all|inet|tcp|udp|raw|unix|unix_dgram|unix_stream|unix_seqpacket|packet|netlink|vsock_stream|vsock_dgram}[,QUERY]


   -D, --diag=FILE     Dump raw information about TCP sockets to FILE
   -F, --filter=FILE   read filter information from FILE
       FILTER := [ state STATE-FILTER ] [ EXPRESSION ]
       STATE-FILTER := {all|connected|synchronized|bucket|big|TCP-STATES}
         TCP-STATES := {established|syn-sent|syn-recv|fin-wait-{1,2}|time-wait|closed|close-wait|last-ack|listen|closing}
          connected := {established|syn-sent|syn-recv|fin-wait-{1,2}|time-wait|close-wait|last-ack|closing}
       synchronized := {established|syn-recv|fin-wait-{1,2}|time-wait|close-wait|last-ack|closing}
             bucket := {syn-recv|time-wait}
                big := {established|syn-sent|fin-wait-{1,2}|closed|close-wait|last-ack|listen|closing}

👆点击查看更多内容👆

文章转载自大侠之运维，如果涉嫌侵权，请发送邮件至：contact@modb.pro进行举报，并提供相关证据，一经查实，墨天轮将立刻删除相关内容。

还在用netstat命令嘛？比netstat好用的ss命令了解下

评论