Next: Returning to ground: real Up: SS Utility: Quick Intro Previous: Filtering by addresses and

Examples

1. List all the tcp sockets in state FIN-WAIT-1 for our apache to network 193.233.7/24 and look at their timers:

$\begin{tscreen} \begin{verbatim}ss -o state fin-wait-1 $ sport = :http or sport = :https $ \ dst 193.233.7/24\end{verbatim} \end{tscreen}$

Oops, forgot to say that missing logical operation is equivalent to and.
2. Well, now look at the rest...

$\begin{tscreen} \begin{verbatim}ss -o excl fin-wait-1 ss state fin-wait-1 $... ...p and sport neq :https $ \ or not dst 193.233.7/24\end{verbatim} \end{tscreen}$

Note that we have to do _two_ calls of ss to do this. State match is always anded to address/port match. The reason for this is purely technical: ss does fast skip of not matching states before parsing addresses and I consider the ability to skip fastly gobs of time-wait and syn-recv sockets as more important than logical generality.
3. So, let's look at all our sockets using autobound ports:

$\begin{tscreen} \begin{verbatim}ss -a -A all autobound\end{verbatim} \end{tscreen}$
4. And eventually find all the local processes connected to local X servers:

$\begin{tscreen} \begin{verbatim}ss -xp dst ''/tmp/.X11-unix/*''\end{verbatim} \end{tscreen}$

Pardon, this does not work with current kernel, patching is required. But we still can look at server side:

$\begin{tscreen} \begin{verbatim}ss -x src ''/tmp/.X11-unix/*''\end{verbatim} \end{tscreen}$