ss (socket stat) β ΡΡΠΎ ΠΈΠ½ΡΡΡΡΠΌΠ΅Π½Ρ ΠΊΠΎΠΌΠ°Π½Π΄Π½ΠΎΠΉ ΡΡΡΠΎΠΊΠΈ, ΠΊΠΎΡΠΎΡΡΠΉ ΠΎΡΡΠ»Π΅ΠΆΠΈΠ²Π°Π΅Ρ ΡΠΎΠ΅Π΄ΠΈΠ½Π΅Π½ΠΈΡ ΡΠΎΠΊΠ΅ΡΠΎΠ² ΠΈ ΠΎΡΠΎΠ±ΡΠ°ΠΆΠ°Π΅Ρ ΡΡΠ°ΡΠΈΡΡΠΈΠΊΡ ΡΠΎΠΊΠ΅ΡΠΎΠ² ΡΠΈΡΡΠ΅ΠΌΡ Linux.
ΠΠ½Π° ΠΌΠΎΠΆΠ΅Ρ ΠΎΡΠΎΠ±ΡΠ°ΠΆΠ°ΡΡ ΡΡΠ°ΡΠΈΡΡΠΈΠΊΡ Π΄Π»Ρ ΡΠΎΠΊΠ΅ΡΠΎΠ² PACKET, ΡΠΎΠΊΠ΅ΡΠΎΠ² TCP, ΡΠΎΠΊΠ΅ΡΠΎΠ² UDP, ΡΠΎΠΊΠ΅ΡΠΎΠ² DCCP, ΡΠΎΠΊΠ΅ΡΠΎΠ² RAW, ΡΠΎΠΊΠ΅ΡΠΎΠ² Π΄ΠΎΠΌΠ΅Π½Π° Unix ΠΈ ΠΌΠ½ΠΎΠ³ΠΎΠ³ΠΎ Π΄ΡΡΠ³ΠΎΠ³ΠΎ.Β Β ΠΠ½Π° Π·Π°ΠΌΠ΅Π½ΡΠ΅Ρ ΡΡΡΠ°ΡΠ΅Π²ΡΡΡ ΠΊΠΎΠΌΠ°Π½Π΄Ρ netstat Π² ΠΏΠΎΡΠ»Π΅Π΄Π½Π΅ΠΉ Π²Π΅ΡΡΠΈΠΈ Linux.Β ΠΠΎΠΌΠ°Π½Π΄Π° ss ΡΠ°Π±ΠΎΡΠ°Π΅Ρ Π½Π°ΠΌΠ½ΠΎΠ³ΠΎ Π±ΡΡΡΡΠ΅Π΅ ΠΈ Π²ΡΠ²ΠΎΠ΄ΠΈΡ Π±ΠΎΠ»Π΅Π΅ ΠΏΠΎΠ΄ΡΠΎΠ±Π½ΡΡ ΡΠ΅ΡΠ΅Π²ΡΡ ΡΡΠ°ΡΠΈΡΡΠΈΠΊΡ, ΡΠ΅ΠΌ ΠΊΠΎΠΌΠ°Π½Π΄Π° netstat.
ΠΡΠ»ΠΈ Π²Ρ Π·Π½Π°ΠΊΠΎΠΌΡ Ρ ΠΊΠΎΠΌΠ°Π½Π΄ΠΎΠΉ netstat, Π²Π°ΠΌ Π±ΡΠ΄Π΅Ρ Π»Π΅Π³ΡΠ΅ ΠΏΠΎΠ½ΡΡΡ ΠΊΠΎΠΌΠ°Π½Π΄Ρ ss, ΠΏΠΎΡΠΊΠΎΠ»ΡΠΊΡ ΠΎΠ½Π° ΠΈΡΠΏΠΎΠ»ΡΠ·ΡΠ΅Ρ Π°Π½Π°Π»ΠΎΠ³ΠΈΡΠ½ΡΠ΅ ΠΏΠ°ΡΠ°ΠΌΠ΅ΡΡΡ ΠΊΠΎΠΌΠ°Π½Π΄Π½ΠΎΠΉ ΡΡΡΠΎΠΊΠΈ Π΄Π»Ρ ΠΎΡΠΎΠ±ΡΠ°ΠΆΠ΅Π½ΠΈΡ ΠΈΠ½ΡΠΎΡΠΌΠ°ΡΠΈΠΈ ΠΎ ΡΠ΅ΡΠ΅Π²ΡΡ ΠΏΠΎΠ΄ΠΊΠ»ΡΡΠ΅Π½ΠΈΡΡ .
ΠΠ΅ΡΠ΅ΠΉΠ΄ΠΈΡΠ΅ ΠΏΠΎ ΡΠ»Π΅Π΄ΡΡΡΠ΅ΠΉ ΡΡΡΠ»ΠΊΠ΅, ΡΡΠΎΠ±Ρ ΡΠ²ΠΈΠ΄Π΅ΡΡ Π΄ΡΡΠ³ΠΈΠ΅ ΡΡΠΊΠΎΠ²ΠΎΠ΄ΡΡΠ²Π° ΠΏΠΎ ΡΠ΅ΡΠ΅Π²ΡΠΌ ΠΊΠΎΠΌΠ°Π½Π΄Π°ΠΌ:
Π‘Π΅ΡΠ΅Π²ΡΠ΅ ΠΊΠΎΠΌΠ°Π½Π΄Ρ Linux / Unix
1) Π‘ΠΏΠΈΡΠΎΠΊ Π²ΡΠ΅Ρ ΠΏΠΎΠ΄ΠΊΠ»ΡΡΠ΅Π½ΠΈΠΉ ΡΠΎΠΊΠ΅ΡΠΎΠ²
ΠΠ°Π·ΠΎΠ²Π°Ρ ΠΊΠΎΠΌΠ°Π½Π΄Π° ss Π±Π΅Π· Π°ΡΠ³ΡΠΌΠ΅Π½ΡΠΎΠ², ΠΊΠΎΡΠΎΡΠ°Ρ ΠΎΡΠΎΠ±ΡΠ°ΠΆΠ°Π΅Ρ Π²ΡΠ΅ ΡΠΎΠΊΠ΅ΡΡ ΠΈΠ»ΠΈ ΡΠ΅ΡΠ΅Π²ΡΠ΅ ΠΏΠΎΠ΄ΠΊΠ»ΡΡΠ΅Π½ΠΈΡ:
$ ss
ΠΠΎΠ½ΠΈΠΌΠ°Π½ΠΈΠ΅ Π·Π°Π³ΠΎΠ»ΠΎΠ²ΠΊΠΎΠ² Π² Π²ΡΠ²ΠΎΠ΄Π΅:
- Netid: Π’ΠΈΠΏ ΡΠΎΠΊΠ΅ΡΠ°. Π Π°ΡΠΏΡΠΎΡΡΡΠ°Π½Π΅Π½Π½ΡΠΌΠΈ ΡΠΈΠΏΠ°ΠΌΠΈ ΡΠ²Π»ΡΡΡΡΡ TCP, UDP, u_str (ΠΏΠΎΡΠΎΠΊ Unix) ΠΈ u_seq (ΠΏΠΎΡΠ»Π΅Π΄ΠΎΠ²Π°ΡΠ΅Π»ΡΠ½ΠΎΡΡΡ Unix).
- State: ΡΠΎΡΡΠΎΡΠ½ΠΈΠ΅ ΡΠΎΠΊΠ΅ΡΠ°. ΠΠ±ΡΠΈΠ΅ ΡΠΎΡΡΠΎΡΠ½ΠΈΡ: ESTAB (ΡΡΡΠ°Π½ΠΎΠ²Π»Π΅Π½ΠΎ), UNCONN (ΠΎΡΠΊΠ»ΡΡΠ΅Π½ΠΎ), LISTEN (ΠΏΡΠΎΡΠ»ΡΡΠΈΠ²Π°Π½ΠΈΠ΅), CLOSE-WAIT ΠΈ SYN-SENT.
- Recv-Q: ΠΊΠΎΠ»ΠΈΡΠ΅ΡΡΠ²ΠΎ ΠΏΠΎΠ»ΡΡΠ΅Π½Π½ΡΡ ΠΏΠ°ΠΊΠ΅ΡΠΎΠ² Π² ΠΎΡΠ΅ΡΠ΅Π΄ΠΈ.
- Send-Q: ΠΊΠΎΠ»ΠΈΡΠ΅ΡΡΠ²ΠΎ ΠΎΡΠΏΡΠ°Π²Π»Π΅Π½Π½ΡΡ ΠΏΠ°ΠΊΠ΅ΡΠΎΠ² Π² ΠΎΡΠ΅ΡΠ΅Π΄ΠΈ.
- Local Address:Port β ΠΠ΄ΡΠ΅Ρ Π»ΠΎΠΊΠ°Π»ΡΠ½ΠΎΠΉ ΠΌΠ°ΡΠΈΠ½Ρ ΠΈ ΠΏΠΎΡΡΠ°.
- Peer Address:Port β ΠΠ΄ΡΠ΅Ρ ΡΠ΄Π°Π»Π΅Π½Π½ΠΎΠ³ΠΎ ΠΊΠΎΠΌΠΏΡΡΡΠ΅ΡΠ° ΠΈ ΠΏΠΎΡΡΠ°.
ΠΡΠ²ΠΎΠ΄ ΠΏΠΎ ΡΠΌΠΎΠ»ΡΠ°Π½ΠΈΡ ΠΏΠΎΠΊΠ°Π·ΡΠ²Π°Π΅Ρ ΡΡΡΡΡΠΈ ΡΡΡΠΎΠΊ ΠΎΠ΄Π½ΠΎΠ²ΡΠ΅ΠΌΠ΅Π½Π½ΠΎ, ΠΈ ΡΠ°ΡΡΡ Π²ΡΠ²ΠΎΠ΄Π° Π½Π΅ Π±ΡΠ΄Π΅Ρ Π²ΠΈΠ΄Π½Π° Π½Π° ΡΠ΅ΡΠΌΠΈΠ½Π°Π»Π΅, ΠΏΠΎΡΡΠΎΠΌΡ ΠΈΡΠΏΠΎΠ»ΡΠ·ΡΠΉΡΠ΅ ΠΊΠΎΠΌΠ°Π½Π΄Ρ Β«ΠΌΠ΅Π½ΡΡΠ΅Β» Π΄Π»Ρ ΠΏΠΎΡΡΡΠ°Π½ΠΈΡΠ½ΠΎΠΉ ΠΎΡΡΠ΅ΡΠ½ΠΎΡΡΠΈ.
$ ss | less Netid State Recv-Q Send-Q Local Address:Port Peer Address:Port u_seq ESTAB 0 0 @0000d 54585 * 54586 u_seq ESTAB 0 0 @0000e 54587 * 54588 u_seq ESTAB 0 0 @0000f 55132 * 55133 u_seq ESTAB 0 0 @00010 55134 * 55135 u_str ESTAB 0 0 * 439093 * 442955 u_str ESTAB 0 0 * 260423 * 260424 u_seq ESTAB 0 0 * 153096 * 153095 u_str ESTAB 0 0 * 57451 * 57450 u_str ESTAB 0 0 * 55382 * 49033 u_str ESTAB 0 0 * 41956 * 41957 u_seq ESTAB 0 0 * 41936 * 41935 u_str ESTAB 0 0 /run/user/1000/bus 39750 * 35633
3) ΠΠ°ΠΊ ΠΏΡΠΎΡΠΌΠΎΡΡΠ΅ΡΡ Π²ΡΠ΅ ΠΏΡΠΎΡΠ»ΡΡΠΈΠ²Π°ΡΡΠΈΠ΅ ΡΠΎΠΊΠ΅ΡΡ
ΠΡΠΎΠ±ΡΠ°Π·ΠΈΠΌ ΡΠΎΠ»ΡΠΊΠΎ ΠΏΡΠΎΡΠ»ΡΡΠΈΠ²Π°ΡΡΠΈΠ΅ ΡΠΎΠ΅Π΄ΠΈΠ½Π΅Π½ΠΈΡ ΡΠΎΠΊΠ΅ΡΠΎΠ² Π² Π½Π°ΡΠ΅ΠΉ ΡΠΈΡΡΠ΅ΠΌΠ΅ Linux, Π΄Π»Ρ ΡΡΠΎΠ³ΠΎ Π·Π°ΠΏΡΡΡΠΈΠΌ:
$ ss -l Netid State Recv-Q Send-Q Local Address:Port Peer Address:Port nl UNCONN 0 0 rtnl:chrome/3578 * nl UNCONN 0 0 rtnl:kernel * nl UNCONN 0 0 rtnl:chrome/3618 * nl UNCONN 0 0 rtnl:mission-control/2102 * nl UNCONN 0 0 rtnl:atom/3381 * nl UNCONN 0 0 rtnl:goa-daemon/2107 * nl UNCONN 0 0 rtnl:firefox/2979 * nl UNCONN 0 0 rtnl:evolution-calen/2207 * nl UNCONN 0 0 rtnl:nscd/1262 * nl UNCONN 0 0 rtnl:gnome-software/2229 * nl UNCONN 0 0 rtnl:avahi-daemon/1184 * nl UNCONN 0 0 rtnl:evolution-addre/2329 * nl UNCONN 0 0 rtnl:wpa_supplicant/1547 *
4) ΠΡΠΎΠ±ΡΠ°ΠΆΠ΅Π½ΠΈΠ΅ ΡΠΎΠ΅Π΄ΠΈΠ½Π΅Π½ΠΈΠΉ ΡΠΎΠΊΠ΅ΡΠΎΠ² TCP
ΠΡΠΎΠ±ΡΠ°Π·ΠΈΠΌ ΡΠΎΠ»ΡΠΊΠΎ ΡΠΎΠ΅Π΄ΠΈΠ½Π΅Π½ΠΈΡ ΡΠΎΠΊΠ΅ΡΠΎΠ² TCP Π² Π½Π°ΡΠ΅ΠΉ ΡΠΈΡΡΠ΅ΠΌΠ΅ Linux,Π΄Π»Ρ ΡΡΠΎΠ³ΠΎ Π·Π°ΠΏΡΡΡΠΈΠΌ:
$ ss -ta State Recv-Q Send-Q Local Address:Port Peer Address:Port ESTAB 0 0 192.168.43.4:38658 142.250.183.2:https ESTAB 0 0 192.168.43.4:47464 142.250.182.227:https ESTAB 0 0 192.168.43.4:40184 34.102.149.62:https ESTAB 0 0 192.168.43.4:34546 23.211.105.67:https ESTAB 0 0 192.168.43.4:41188 52.37.132.164:https ESTAB 0 0 192.168.43.4:34548 23.211.105.67:https ESTAB 0 0 192.168.43.4:57118 142.250.196.34:https ESTAB 0 0 192.168.43.4:59392 35.244.159.8:https ESTAB 0 0 192.168.43.4:49948 94.237.76.92:ssh ESTAB 0 0 192.168.43.4:52680 142.250.77.34:https
4-a) ΠΡΠΎΠ±ΡΠ°ΠΆΠ΅Π½ΠΈΠ΅ ΡΠΎΠ΅Π΄ΠΈΠ½Π΅Π½ΠΈΠΉ ΡΠΎΠΊΠ΅ΡΠΎΠ² UDP
$ ss -ua State Recv-Q Send-Q Local Address:Port Peer Address:Port UNCONN 0 0 192.168.43.4:46312 0.0.0.0:* UNCONN 0 0 224.0.0.251:mdns 0.0.0.0:* UNCONN 0 0 224.0.0.251:mdns 0.0.0.0:* UNCONN 0 0 0.0.0.0:mdns 0.0.0.0:* UNCONN 0 0 0.0.0.0:47347 0.0.0.0:* UNCONN 0 0 192.168.43.4:56078 0.0.0.0:* ESTAB 0 0 192.168.43.4%wlan0:bootpc 192.168.43.1:bootps UNCONN 0 0 [::]:mdns [::]:* UNCONN 0 0 [2402:3a80:462:e78:e4ca:8bb:a7ae:8888]:40157 [::]:* UNCONN 0 0 [::]:48993 [::]:* UNCONN 0 0 [2402:3a80:462:e78:e4ca:8bb:a7ae:8888]:33353 [::]:* ESTAB 0 0 [2402:3a80:462:e78:e4ca:8bb:a7ae:8888]:33597 [2404:6800:4009:809::2004]:https
4-Π±) ΠΡΠΎΠ±ΡΠ°ΠΆΠ΅Π½ΠΈΠ΅ ΡΠΎΠ΅Π΄ΠΈΠ½Π΅Π½ΠΈΠΉ ΡΠΎΠΊΠ΅ΡΠΎΠ² UNIX
$ ss -xa Netid State Recv-Q Send-Q Local Address:Port Peer Address:Port u_str LISTEN 0 128 /run/systemd/journal/stdout 13825 * 0 u_str LISTEN 0 128 /tmp/.ICE-unix/1989 36552 * 0 u_dgr UNCONN 0 0 /run/systemd/journal/socket 13827 * 0 u_str LISTEN 0 5 /tmp/.esd-1000/socket 40072 * 0 u_str LISTEN 0 1 /tmp/.X11-unix/X0 37262 * 0 u_str LISTEN 0 128 /run/user/1000/keyring/.ssh 514311 * 0 u_str LISTEN 0 128 @/tmp/.ICE-unix/1989 36551 * 0 u_str LISTEN 0 10 /run/mcelog/mcelog-client 28958 * 0 u_str LISTEN 0 128 /var/run/nscd/socket 29728 * 0 u_str LISTEN 0 1 @/tmp/.X11-unix/X0 37261 * 0
4-Π²) ΠΡΠΎΠ±ΡΠ°ΠΆΠ΅Π½ΠΈΠ΅ RAW ΡΠΎΠΊΠ΅ΡΠΎΠ²
$ ss -wa State Recv-Q Send-Q Local Address:Port Peer Address:Port UNCONN 0 0 *:ipv6-icmp *:*
5) ΠΡΠ²ΠΎΠ΄ ΡΠΎΠ»ΡΠΊΠΎ ΠΏΡΠΎΡΠ»ΡΡΠΈΠ²Π°ΡΡΠΈΡ TCP-ΡΠΎΠΊΠ΅ΡΠ½ΡΡ ΡΠΎΠ΅Π΄ΠΈΠ½Π΅Π½ΠΈΠΉ
Π§ΡΠΎΠ±Ρ Π²ΡΠ²Π΅ΡΡΠΈ ΡΠΎΠ»ΡΠΊΠΎ ΠΏΡΠΎΡΠ»ΡΡΠΈΠ²Π°ΡΡΠΈΠ΅ ΡΠΎΠ΅Π΄ΠΈΠ½Π΅Π½ΠΈΡ TCP-ΡΠΎΠΊΠ΅ΡΠ°, Π·Π°ΠΏΡΡΡΠΈΡΠ΅:
$ ss -ltn State Recv-Q Send-Q Local Address:Port Peer Address:Port LISTEN 0 128 0.0.0.0:22 0.0.0.0:* LISTEN 0 5 127.0.0.1:631 0.0.0.0:* LISTEN 0 100 127.0.0.1:25 0.0.0.0:* LISTEN 0 10 0.0.0.0:3689 0.0.0.0:* LISTEN 0 128 [::]:22 [::]:* LISTEN 0 5 [::1]:631 [::]:* LISTEN 0 100 [::1]:25 [::]:* LISTEN 0 10 [::]:3689 [::]:*
6) Π‘ΠΏΠΈΡΠΎΠΊ ΠΏΠΎΠ΄ΠΊΠ»ΡΡΠ΅Π½ΠΈΠΉ ΡΠΎΠΊΠ΅ΡΠΎΠ² IPv4 ΠΈ IPv6
Π§ΡΠΎΠ±Ρ ΠΎΡΠΎΠ±ΡΠ°Π·ΠΈΡΡ ΡΠΎΠ»ΡΠΊΠΎ ΠΏΠΎΠ΄ΠΊΠ»ΡΡΠ΅Π½ΠΈΡ ΠΊ ΡΠΎΠΊΠ΅ΡΠ°ΠΌ IPv4, Π·Π°ΠΏΡΡΡΠΈΡΠ΅:
$ ss -4 Netid State Recv-Q Send-Q Local Address:Port Peer Address:Port udp ESTAB 0 0 192.168.43.4%wlan0:bootpc 192.168.43.1:bootps tcp ESTAB 0 0 192.168.43.4:41188 52.37.132.164:https tcp ESTAB 0 0 192.168.43.4:59392 35.244.159.8:https tcp ESTAB 0 0 192.168.43.4:49948 94.237.76.92:ssh tcp CLOSE-WAIT 1 0 192.168.43.4:50232 35.244.247.133:https tcp ESTAB 0 0 192.168.43.4:51714 142.250.77.34:https tcp ESTAB 0 0 192.168.43.4:51724 142.250.77.34:https tcp ESTAB 0 0 192.168.43.4:56566 13.227.129.99:https tcp ESTAB 0 0 192.168.43.4:48470 142.250.183.98:https tcp ESTAB 0 0 192.168.43.4:56718 216.58.196.66:https
7) ΠΡΠ²Π΅Π΄Π΅ΠΌ ΠΈΠΌΠ΅Π½Π° ΠΏΡΠΎΡΠ΅ΡΡΠΎΠ² ΠΈ pidΡ Ρ ΠΏΠΎΠΌΠΎΡΡΡ ΠΊΠΎΠΌΠ°Π½Π΄Ρ ss
Π§ΡΠΎΠ±Ρ ΠΏΠ΅ΡΠ΅ΡΠΈΡΠ»ΠΈΡΡ ΠΈΠΌΡ ΠΏΡΠΎΡΠ΅ΡΡΠ° ΠΈ pid, ΡΠ²ΡΠ·Π°Π½Π½ΡΠ΅ Ρ ΡΠ΅ΡΠ΅Π²ΡΠΌΠΈ ΠΏΠΎΠ΄ΠΊΠ»ΡΡΠ΅Π½ΠΈΡΠΌΠΈ, Π²ΡΠΏΠΎΠ»Π½ΠΈΡΠ΅:
ΠΠ°ΠΌ Π½ΡΠΆΠ½ΠΎ Π·Π°ΠΏΡΡΡΠΈΡΡ ΡΡΡ ΠΊΠΎΠΌΠ°Π½Π΄Ρ Ρ ΠΏΡΠΈΠ²ΠΈΠ»Π΅Π³ΠΈΠ΅ΠΉ sudo, ΡΡΠΎΠ±Ρ ΠΏΡΠΎΡΠΌΠΎΡΡΠ΅ΡΡ Π²ΡΠ΅ ΠΈΠΌΠ΅Π½Π° ΠΏΡΠΎΡΠ΅ΡΡΠΎΠ² ΠΈ ΡΠ²ΡΠ·Π°Π½Π½ΡΠ΅ pid.
$ sudo ss -ltp
[sudo] password for root:
State Recv-Q Send-Q Local Address:Port Peer Address:Port
LISTEN 0 128 0.0.0.0:ssh 0.0.0.0:* users:(("sshd",pid=1338,fd=3))
LISTEN 0 5 127.0.0.1:ipp 0.0.0.0:* users:(("cupsd",pid=1260,fd=7))
LISTEN 0 100 127.0.0.1:smtp 0.0.0.0:* users:(("master",pid=1630,fd=13))
LISTEN 0 10 0.0.0.0:daap 0.0.0.0:* users:(("rhythmbox",pid=16209,fd=18))
LISTEN 0 128 [::]:ssh [::]:* users:(("sshd",pid=1338,fd=4))
LISTEN 0 5 [::1]:ipp [::]:* users:(("cupsd",pid=1260,fd=6))
LISTEN 0 100 [::1]:smtp [::]:* users:(("master",pid=1630,fd=14))
LISTEN 0 10 [::]:daap [::]:* users:(("rhythmbox",pid=16209,fd=19))8) ΠΠΎΠΊΠ°Π·Π°ΡΡ ΠΈΠ½ΡΠΎΡΠΌΠ°ΡΠΈΡ ΠΎ ΡΠ°ΠΉΠΌΠ΅ΡΠ΅ ΠΏΠΎΠ΄ΠΊΠ»ΡΡΠ΅Π½ΠΈΠΉ ΡΠΎΠΊΠ΅ΡΠΎΠ²
Π§ΡΠΎΠ±Ρ ΠΏΠΎΠΊΠ°Π·Π°ΡΡ, ΠΊΠ°ΠΊ Π΄ΠΎΠ»Π³ΠΎ βΠΆΠΈΠ²Π΅Ρβ ΡΠΎΠ΅Π΄ΠΈΠ½Π΅Π½ΠΈΠ΅ ΡΠΎΠΊΠ΅ΡΠ°, Π·Π°ΠΏΡΡΡΠΈΡΠ΅:
$ ss -tn -o State Recv-Q Send-Q Local Address:Port Peer Address:Port ESTAB 0 0 192.168.43.4:41188 52.37.132.164:443 timer:(keepalive,9min54sec,0) ESTAB 0 0 192.168.43.4:59392 35.244.159.8:443 ESTAB 0 0 192.168.43.4:50678 103.43.90.19:443 timer:(keepalive,9.512ms,0) ESTAB 0 0 192.168.43.4:49948 94.237.76.92:22 timer:(keepalive,38min,0) ESTAB 0 0 192.168.43.4:36528 182.161.72.130:443 ESTAB 0 0 192.168.43.4:48704 142.250.192.66:443 ESTAB 0 0 192.168.43.4:38544 103.43.89.4:443 timer:(keepalive,8sec,0) ESTAB 0 517 192.168.43.4:57978 182.161.72.137:443 timer:(on,288ms,0)
9) ΠΠ°ΠΊ Π²ΡΠ²Π΅ΡΡΠΈ ΡΠ²ΠΎΠ΄Π½ΡΡ ΡΡΠ°ΡΠΈΡΡΠΈΠΊΡ
Π§ΡΠΎΠ±Ρ ΠΏΡΠΎΡΠΌΠΎΡΡΠ΅ΡΡ ΠΎΠ±ΡΡΡ ΡΠ²ΠΎΠ΄ΠΊΡ Π²ΡΠ΅Ρ ΠΏΠΎΠ΄ΠΊΠ»ΡΡΠ΅Π½ΠΈΠΉ ΠΊ ΡΠΎΠΊΠ΅ΡΠ°ΠΌ, Π·Π°ΠΏΡΡΡΠΈΡΠ΅:
$ ss -s Total: 1278 TCP: 35 (estab 10, closed 11, orphaned 0, timewait 2) Transport Total IP IPv6 RAW 1 0 1 UDP 11 7 4 TCP 24 13 11 INET 36 20 16 FRAG 0 0 0
ΠΠΎΠΌΠ°Π½Π΄Π° Π²ΡΠ²Π΅Π΄Π΅Ρ ΡΠ΅Π·ΡΠ»ΡΡΠ°ΡΡ Π² ΡΠ°Π±Π»ΠΈΡΠ½ΠΎΠΌ ΡΠΎΡΠΌΠ°ΡΠ΅, Π²ΠΊΠ»ΡΡΠ°Ρ ΠΊΠΎΠ»ΠΈΡΠ΅ΡΡΠ²ΠΎ ΠΏΠΎΠ΄ΠΊΠ»ΡΡΠ΅Π½ΠΈΠΉ ΠΊ ΡΠΎΠΊΠ΅ΡΠ°ΠΌ TCP ΠΈ UDP, IPv4 ΠΈ IPv6.
10) ΠΡΠΎΡΠΌΠΎΡΡ ΡΠ°ΡΡΠΈΡΠ΅Π½Π½ΠΎΠ³ΠΎ Π²ΡΠ²ΠΎΠ΄Π° ΡΠΎΠ΅Π΄ΠΈΠ½Π΅Π½ΠΈΠΉ ΡΠΎΠΊΠ΅ΡΠΎΠ²
Π§ΡΠΎΠ±Ρ ΠΏΡΠΎΡΠΌΠΎΡΡΠ΅ΡΡ ΡΠ°ΡΡΠΈΡΠ΅Π½Π½ΡΠΉ Π²ΡΠ²ΠΎΠ΄ ΠΏΠΎΠ΄ΠΊΠ»ΡΡΠ΅Π½ΠΈΠΉ ΡΠΎΠΊΠ΅ΡΠΎΠ², Π²ΡΠΏΠΎΠ»Π½ΠΈΡΠ΅:
$ ss -lte State Recv-Q Send-Q Local Address:Port Peer Address:Port LISTEN 0 128 0.0.0.0:ssh 0.0.0.0:* ino:27515 sk:4dc <-> LISTEN 0 5 127.0.0.1:ipp 0.0.0.0:* ino:30778 sk:4dd <-> LISTEN 0 100 127.0.0.1:smtp 0.0.0.0:* ino:34118 sk:4de <-> LISTEN 0 10 0.0.0.0:daap 0.0.0.0:* uid:1000 ino:442177 sk:586 <-> LISTEN 0 128 [::]:ssh [::]:* ino:27517 sk:4f3 v6only:1 <-> LISTEN 0 5 [::1]:ipp [::]:* ino:30777 sk:4f4 v6only:1 <-> LISTEN 0 100 [::1]:smtp [::]:* ino:34119 sk:4f5 v6only:1 <-> LISTEN 0 10 [::]:daap [::]:* uid:1000 ino:442178 sk:587 v6only:1 <->
Π Π°ΡΡΠΈΡΠ΅Π½Π½ΡΠΉ Π²ΡΠ²ΠΎΠ΄ Π±ΡΠ΄Π΅Ρ ΠΎΡΠΎΠ±ΡΠ°ΠΆΠ°ΡΡ uid ΡΠΎΠΊΠ΅ΡΠ° ΠΈ Π½ΠΎΠΌΠ΅Ρ inode ΡΠΎΠΊΠ΅ΡΠ°.
11) ΠΡΠΎΠ±ΡΠ°ΠΆΠ΅Π½ΠΈΠ΅ ΠΈΡΠΏΠΎΠ»ΡΠ·ΠΎΠ²Π°Π½ΠΈΡ ΠΏΠ°ΠΌΡΡΠΈ ΡΠΎΠΊΠ΅ΡΠ½ΡΠΌΠΈ ΡΠΎΠ΅Π΄ΠΈΠ½Π΅Π½ΠΈΡΠΌΠΈ
Π§ΡΠΎΠ±Ρ ΡΠ·Π½Π°ΡΡ, ΡΠΊΠΎΠ»ΡΠΊΠΎ ΠΏΠ°ΠΌΡΡΠΈ Π·Π°Π½ΡΡΠΎ ΡΠΎΠΊΠ΅ΡΠ½ΡΠΌ ΠΏΠΎΠ΄ΠΊΠ»ΡΡΠ΅Π½ΠΈΠ΅ΠΌ, Π·Π°ΠΏΡΡΡΠΈΡΠ΅:
$ ss -ltm
State Recv-Q Send-Q Local Address:Port Peer Address:Port
LISTEN 0 128 0.0.0.0:ssh 0.0.0.0:*
skmem:(r0,rb131072,t0,tb16384,f0,w0,o0,bl0,d0)
LISTEN 0 5 127.0.0.1:ipp 0.0.0.0:*
skmem:(r0,rb131072,t0,tb16384,f0,w0,o0,bl0,d0)
LISTEN 0 100 127.0.0.1:smtp 0.0.0.0:*
skmem:(r0,rb131072,t0,tb16384,f0,w0,o0,bl0,d0)
LISTEN 0 10 0.0.0.0:daap 0.0.0.0:*
skmem:(r0,rb131072,t0,tb16384,f0,w0,o0,bl0,d0)
LISTEN 0 128 [::]:ssh [::]:*
skmem:(r0,rb131072,t0,tb16384,f0,w0,o0,bl0,d0)
LISTEN 0 5 [::1]:ipp [::]:*
skmem:(r0,rb131072,t0,tb16384,f0,w0,o0,bl0,d0)
LISTEN 0 100 [::1]:smtp [::]:*
skmem:(r0,rb131072,t0,tb16384,f0,w0,o0,bl0,d0)
LISTEN 0 10 [::]:daap [::]:*
skmem:(r0,rb131072,t0,tb16384,f0,w0,o0,bl0,d0)12) ΠΡΡΠΈΠ»ΡΡΡΡΠΌΡΠΎΠ΅Π΄ΠΈΠ½Π΅Π½ΠΈΡ Ρ ΠΏΠΎΠΌΠΎΡΡΡ ΠΊΠΎΠΌΠ°Π½Π΄Ρ ss
ΠΠΎΠΌΠ°Π½Π΄Π° ss ΠΎΠ±Π΅ΡΠΏΠ΅ΡΠΈΠ²Π°Π΅Ρ ΡΠ°ΡΡΠΈΡΠ΅Π½Π½ΡΡ ΡΠΈΠ»ΡΡΡΠ°ΡΠΈΡ, ΠΊΠΎΡΠΎΡΡΡ ΠΌΠΎΠΆΠ½ΠΎ ΠΈΡΠΏΠΎΠ»ΡΠ·ΠΎΠ²Π°ΡΡ Π΄Π»Ρ ΡΠΈΠ»ΡΡΡΠ°ΡΠΈΠΈ ΠΎΠΏΡΠ΅Π΄Π΅Π»Π΅Π½Π½ΡΡ ΡΠΎΠ΅Π΄ΠΈΠ½Π΅Π½ΠΈΠΉ, ΡΡΠ°ΡΠΈΡΡΠΈΠΊΠΈ, ΠΏΠΎΡΡΠ°, Π°Π΄ΡΠ΅ΡΠ° ΠΈΠ»ΠΈ ΡΠ»ΡΠΆΠ±Ρ ΠΈ Ρ. Π΄.
12-a) Π€ΠΈΠ»ΡΡΡΠ°ΡΠΈΡ ΡΠΎΠ΅Π΄ΠΈΠ½Π΅Π½ΠΈΠΉ ΡΠΎΠΊΠ΅ΡΠΎΠ² ΠΏΠΎ ΡΠΎΡΡΠΎΡΠ½ΠΈΡ
Syntax: ss [option] [state] [name of the socet state]
Π§ΡΠΎΠ±Ρ ΠΎΡΠΎΠ±ΡΠ°Π·ΠΈΡΡ Π²ΡΠ΅ ΡΠΎΠΊΠ΅ΡΡ tcp, ΠΊΠΎΡΠΎΡΡΠ΅ Π½Π°Ρ ΠΎΠ΄ΡΡΡΡ Π² ΡΠΎΡΡΠΎΡΠ½ΠΈΠΈ Β«linsteningΒ», Π·Π°ΠΏΡΡΡΠΈΡΠ΅:
$ ss -lt state established Recv-Q Send-Q Local Address:Port Peer Address:Port 0 0 192.168.43.4:39008 142.250.192.2:https 0 0 192.168.43.4:41188 52.37.132.164:https 0 0 192.168.43.4:59392 35.244.159.8:https 0 0 192.168.43.4:49948 94.237.76.92:ssh 0 0 192.168.43.4:48704 142.250.192.66:https 0 0 192.168.43.4:51714 142.250.77.34:https
ΠΡΡΠ³ΠΎΠ΅ ΠΎΠ±ΡΠ΅Π΅ ΡΠΎΡΡΠΎΡΠ½ΠΈΠ΅ ΠΌΠΎΠΆΠ΅Ρ Π±ΡΡΡ:
- closed
- syn-sent
- syn-recv
- fin-wait-1
- time-wait
- close-wait
- connected
- synchronized
12-Π±) Π€ΠΈΠ»ΡΡΡΠ°ΡΠΈΡ ΡΠΎΠ΅Π΄ΠΈΠ½Π΅Π½ΠΈΠΉ ΡΠΎΠΊΠ΅ΡΠΎΠ² ΠΏΠΎ Π½ΠΎΠΌΠ΅ΡΡ ΠΏΠΎΡΡΠ°
Syntax: ss [option] dport = :[port number] ss [option] sport = :[port number] ss [option] '( dport = :[port number] or sport = :[port number] )'
Π§ΡΠΎΠ±Ρ ΠΎΡΡΠΈΠ»ΡΡΡΠΎΠ²Π°ΡΡ ΡΠΎΠΊΠ΅ΡΡ ΠΏΠΎ Π½ΠΎΠΌΠ΅ΡΡ ΠΏΠΎΡΡΠ°, Π·Π°ΠΏΡΡΡΠΈΡΠ΅ ΠΏΠΎΠΊΠ°Π·Π°Π½Π½ΡΠ΅ Π½ΠΈΠΆΠ΅ ΠΏΡΠΈΠΌΠ΅ΡΡ.
ΠΠ°ΠΏΡΠΈΠΌΠ΅Ρ, ΡΡΠΎΠ±Ρ ΠΎΡΡΠΈΠ»ΡΡΡΠΎΠ²Π°ΡΡ ΡΠ»ΡΠΆΠ±Ρ ssh, Π²Ρ ΠΌΠΎΠΆΠ΅ΡΠ΅ ΠΏΡΠΈ Π½Π΅ΠΎΠ±Ρ ΠΎΠ΄ΠΈΠΌΠΎΡΡΠΈ Π²ΡΠΏΠΎΠ»Π½ΠΈΡΡ ΡΠ»Π΅Π΄ΡΡΡΠΈΠ΅ ΠΊΠΎΠΌΠ°Π½Π΄Ρ.
$ ss -at dport = :22 State Recv-Q Send-Q Local Address:Port Peer Address:Port ESTAB 0 0 192.168.43.4:49948 94.237.76.92:ssh
$ ss -lt sport = :22 State Recv-Q Send-Q Local Address:Port Peer Address:Port LISTEN 0 128 0.0.0.0:ssh 0.0.0.0:* LISTEN 0 128 [::]:ssh [::]:*
$ ss -at dst :22 State Recv-Q Send-Q Local Address:Port Peer Address:Port ESTAB 0 0 192.168.43.4:49948 94.237.76.92:ssh
$ ss -at src :22 State Recv-Q Send-Q Local Address:Port Peer Address:Port LISTEN 0 128 0.0.0.0:ssh 0.0.0.0:* LISTEN 0 128 [::]:ssh [::]:*
$ ss -at '( dport = :22 or sport = :22 )' State Recv-Q Send-Q Local Address:Port Peer Address:Port LISTEN 0 128 0.0.0.0:ssh 0.0.0.0:* ESTAB 0 0 192.168.43.4:49948 94.237.76.92:ssh LISTEN 0 128 [::]:ssh [::]:*
Π§ΡΠΎΠ±Ρ ΠΎΡΡΠΈΠ»ΡΡΡΠΎΠ²Π°ΡΡ ΡΡΠ°Π·Ρ Π½Π΅ΡΠΊΠΎΠ»ΡΠΊΠΎ ΠΏΠΎΡΡΠΎΠ², Π·Π°ΠΏΡΡΡΠΈΡΠ΅:
$ ss -nt '( dst :443 or dst :22 )' State Recv-Q Send-Q Local Address:Port Peer Address:Port ESTAB 0 0 192.168.43.4:41188 52.37.132.164:443 ESTAB 0 0 192.168.43.4:44970 103.43.90.20:443 ESTAB 0 0 192.168.43.4:59392 35.244.159.8:443 ESTAB 0 0 192.168.43.4:43254 34.95.69.49:443 SYN-SENT 0 1 192.168.43.4:58884 182.161.72.137:443 ESTAB 0 0 192.168.43.4:49948 94.237.76.92:22 CLOSE-WAIT 1 0 192.168.43.4:50232 35.244.247.133:443
12-c) Π€ΠΈΠ»ΡΡΡΠ°ΡΠΈΡ ΡΠΎΠ΅Π΄ΠΈΠ½Π΅Π½ΠΈΠΉ ΡΠΎΠΊΠ΅ΡΠΎΠ² ΠΏΠΎ ΠΈΠΌΠ΅Π½ΠΈ ΡΠ»ΡΠΆΠ±Ρ
Π’ΠΎΡΠ½ΠΎ ΡΠ°ΠΊ ΠΆΠ΅ Π²Ρ ΠΌΠΎΠΆΠ΅ΡΠ΅ ΡΠΈΠ»ΡΡΡΠΎΠ²Π°ΡΡ ΡΠΎΠ΅Π΄ΠΈΠ½Π΅Π½ΠΈΡ ΡΠΎΠΊΠ΅ΡΠΎΠ² Π½Π° ΠΎΡΠ½ΠΎΠ²Π΅ ΠΈΠΌΠ΅Π½ΠΈ ΡΠ»ΡΠΆΠ±Ρ!
$ ss -at dport = :ssh State Recv-Q Send-Q Local Address:Port Peer Address:Port ESTAB 0 0 192.168.43.4:49948 94.237.76.92:ssh
$ ss -lt sport = :ssh State Recv-Q Send-Q Local Address:Port Peer Address:Port LISTEN 0 128 0.0.0.0:ssh 0.0.0.0:* LISTEN 0 128 [::]:ssh [::]:*
$ ss -at dst :https State Recv-Q Send-Q Local Address:Port Peer Address:Port ESTAB 0 0 192.168.43.4:45084 103.43.90.20:https ESTAB 0 0 192.168.43.4:45076 103.43.90.20:https ESTAB 0 0 192.168.43.4:41188 52.37.132.164:https ESTAB 0 0 192.168.43.4:59392 35.244.159.8:https ESTAB 0 0 192.168.43.4:43254 34.95.69.49:https
$ ss -at src :ssh State Recv-Q Send-Q Local Address:Port Peer Address:Port LISTEN 0 128 0.0.0.0:ssh 0.0.0.0:* LISTEN 0 128 [::]:ssh [::]:*
$ ss -at '( dport = :ssh or sport = :ssh )' State Recv-Q Send-Q Local Address:Port Peer Address:Port LISTEN 0 128 0.0.0.0:ssh 0.0.0.0:* ESTAB 0 0 192.168.43.4:49948 94.237.76.92:ssh LISTEN 0 128 [::]:ssh [::]:*
$ ss -at '( dst :https or dst :ssh )' State Recv-Q Send-Q Local Address:Port Peer Address:Port ESTAB 0 0 192.168.43.4:41188 52.37.132.164:https ESTAB 0 0 192.168.43.4:59392 35.244.159.8:https ESTAB 0 0 192.168.43.4:49948 94.237.76.92:ssh CLOSE-WAIT 1 0 192.168.43.4:50232 35.244.247.133:https ESTAB 0 0 192.168.43.4:51714 142.250.77.34:https
$ ss -at '( dst :https or src :ssh )' State Recv-Q Send-Q Local Address:Port Peer Address:Port LISTEN 0 128 0.0.0.0:ssh 0.0.0.0:* ESTAB 0 0 192.168.43.4:41188 52.37.132.164:https ESTAB 0 0 192.168.43.4:59392 35.244.159.8:https CLOSE-WAIT 1 0 192.168.43.4:50232 35.244.247.133:https ESTAB 0 0 192.168.43.4:51714 142.250.77.34:https
$ ss -at '( src :smtp or src :ssh )' State Recv-Q Send-Q Local Address:Port Peer Address:Port LISTEN 0 128 0.0.0.0:ssh 0.0.0.0:* LISTEN 0 100 127.0.0.1:smtp 0.0.0.0:* LISTEN 0 128 [::]:ssh [::]:* LISTEN 0 100 [::1]:smtp [::]:*
12-Π³) Π€ΠΈΠ»ΡΡΡΠ°ΡΠΈΡ ΡΠΎΠΊΠ΅ΡΠΎΠ² ΠΏΠΎ IP-Π°Π΄ΡΠ΅ΡΡ
Π§ΡΠΎΠ±Ρ Π²ΡΠ²Π΅ΡΡΠΈ ΡΠΏΠΈΡΠΎΠΊ ΠΏΠΎΠ΄ΠΊΠ»ΡΡΠ΅Π½ΠΈΠΉ ΠΊ ΠΎΠΏΡΠ΅Π΄Π΅Π»Π΅Π½Π½ΠΎΠΌΡ IP-Π°Π΄ΡΠ΅ΡΡ Π½Π°Π·Π½Π°ΡΠ΅Π½ΠΈΡ, Π·Π°ΠΏΡΡΡΠΈΡΠ΅:
Syntax: ss [option] dst [IP Address]
ΠΠ°ΠΏΡΠΈΠΌΠ΅Ρ, ΡΡΠΎΠ±Ρ ΠΏΡΠΎΡΠΌΠΎΡΡΠ΅ΡΡ ΡΠΏΠΈΡΠΎΠΊ ΠΏΠΎΠ΄ΠΊΠ»ΡΡΠ΅Π½ΠΈΠΉ, ΡΡΡΠ°Π½ΠΎΠ²Π»Π΅Π½Π½ΡΡ ΠΊ ΠΎΠΏΡΠ΅Π΄Π΅Π»Π΅Π½Π½ΠΎΠΌΡ IP-Π°Π΄ΡΠ΅ΡΡ, Π·Π°ΠΏΡΡΡΠΈΡΠ΅:
$ ss -at dst 192.168.43.40 State Recv-Q Send-Q Local Address:Port Peer Address:Port ESTAB 0 0 192.168.43.4:49948 192.168.43.40:ssh
ΠΡΠ»ΠΈ Π²Ρ Ρ ΠΎΡΠΈΡΠ΅ ΠΈΠ·ΡΡΠΈΡΡ Π΄ΡΡΠ³ΠΈΠ΅ ΠΏΠ°ΡΠ°ΠΌΠ΅ΡΡΡ, Π½Π΅Π΄ΠΎΡΡΡΠΏΠ½ΡΠ΅ Π² ΡΡΠΎΠΌ ΡΡΠΊΠΎΠ²ΠΎΠ΄ΡΡΠ²Π΅, ΠΏΠΎΡΠ΅ΡΠΈΡΠ΅ ΡΡΡΠ°Π½ΠΈΡΡ ΡΡΠΊΠΎΠ²ΠΎΠ΄ΡΡΠ²Π° ΠΏΠΎ ΠΊΠΎΠΌΠ°Π½Π΄Π΅ ss.
$ man ss ΠΈΠ»ΠΈ $ ss --help
ΠΠ°ΠΊΠ»ΡΡΠ΅Π½ΠΈΠ΅
Π ΡΡΠΎΠΌ ΡΡΠΊΠΎΠ²ΠΎΠ΄ΡΡΠ²Π΅ ΠΌΡ ΠΏΠΎΠΊΠ°Π·Π°Π»ΠΈ Π²Π°ΠΌ, ΠΊΠ°ΠΊ ΠΈΡΠΏΠΎΠ»ΡΠ·ΠΎΠ²Π°ΡΡ ΠΊΠΎΠΌΠ°Π½Π΄Ρ ss Π² Linux, Π½Π° Π½Π΅ΡΠΊΠΎΠ»ΡΠΊΠΈΡ ΠΏΡΠΈΠΌΠ΅ΡΠ°Ρ , Π²ΠΊΠ»ΡΡΠ°Ρ ΡΠ°Π·Π»ΠΈΡΠ½ΡΠ΅ ΠΏΠ°ΡΠ°ΠΌΠ΅ΡΡΡ ΡΠΈΠ»ΡΡΡΠ°ΡΠΈΠΈ.
ΠΡΠ»ΠΈ Ρ Π²Π°Ρ Π΅ΡΡΡ ΠΊΠ°ΠΊΠΈΠ΅-Π»ΠΈΠ±ΠΎ Π²ΠΎΠΏΡΠΎΡΡ ΠΈΠ»ΠΈ ΠΎΡΠ·ΡΠ²Ρ, Π½Π΅ ΡΡΠ΅ΡΠ½ΡΠΉΡΠ΅ΡΡ ΠΎΡΡΠ°Π²Π»ΡΡΡ ΠΊΠΎΠΌΠΌΠ΅Π½ΡΠ°ΡΠΈΠΈ!