sys-cmd ss

sys-cmd ss lists the TCP and UDP connections, the listening ports and the processes that hold those ports in the route table selected in WEB-CLI. It is used to see whether the port of a vService is really being listened on, how many connections are open to a backend, or in which state the connections are accumulating.

Command Summary

TR7 WEB-CLI · sys-cmd ss

# type ss and press Tab: a free parameter

admin@TR7LBWAF01> sys-cmd ss

<ss-parameter-1>

 

admin@TR7LBWAF01> sys-cmd ss <parameters> <filter>

admin@TR7LBWAF01>  

Everything written after the word ss is passed to the tool as it is. There is no mandatory field; if a parameter is not given, the open sockets other than the listening ones are listed.

How It Works

Subject	Behavior
Context	It shows the connections of the selected v-device and route table; for the connections in another route table, route-table set is run first.
The rejected parameters	-F, --filter, -D and --diag (and their spellings such as -F=… that use =) are rejected; an error in the form -F is not allowed for ss is written to the screen. The filter cannot be read from a file, it is written directly on the command line.
Duration	It writes the list and closes immediately.
Pipe	The output can be filtered or counted with |, or written to a file with to-file.
Recording	Every run is written to the user logs.

Frequently Used Parameters

Parameter	What it does	What is written after it
-t	Shows only the TCP connections	—
-u	Shows only the UDP sockets	—
-l	Shows only the listening ports	—
-a	Shows all the sockets including the listening ones	—
-n	Writes the ports and the addresses without resolving them to names	—
-p	Adds the name and the identifier of the process that holds the socket	—
-s	Writes only a summary of the totals	—
-o	Adds the timer information	—
state	Filters the connections by state	established · syn-sent · time-wait · close-wait · listening
dst · src	Filters by the remote or the local address	An IP address (e.g. dst 10.20.0.30)
dport · sport	Filters by the remote or the local port	In the = :443 form

The parameters can be written combined (-tlnp). Filter expressions that contain parentheses are put in single quotation marks: '( sport = :443 or sport = :80 )'. The table summarizes the frequently used parameters; the full list depends on the version of the tool on the device.

Examples

TR7 WEB-CLI · A) The listening TCP ports and their processes

admin@TR7LBWAF01> sys-cmd ss -tlnp

admin@TR7LBWAF01>  

TR7 WEB-CLI · B) The connections open to the backend and their count

admin@TR7LBWAF01> sys-cmd ss -tn state established dst 10.20.0.30

admin@TR7LBWAF01> sys-cmd ss -tn state established dst 10.20.0.30 | wc -l

admin@TR7LBWAF01>  

TR7 WEB-CLI · C) The connections coming to ports 443 and 80

admin@TR7LBWAF01> sys-cmd ss -tn '( sport = :443 or sport = :80 )'

admin@TR7LBWAF01>  

TR7 WEB-CLI · D) The summary and the connections waiting to close

admin@TR7LBWAF01> sys-cmd ss -s

admin@TR7LBWAF01> sys-cmd ss -tan state close-wait

admin@TR7LBWAF01>  

Things to Know

• The port is not in the list. The vService or the service may not be listening in that route table; the listeners in a different route table are not seen in the selected context.
• close-wait accumulation. It shows that although the other side has closed the connection, the local application has not; whether the number increases over time is followed with a few measurements.
• The number of lines. The output of | wc -l also counts the header line.
• For the routing table and the interface statistics netstat is used.