/commands/ss/ss-filter-by-port-or-address
ss filter by port or IP: ss -tn 'dport = :443' and dst 10.0.0.5
- tool
- ss / netstat
- versions
- iproute2 5.x, iproute2 6.x
- os
- linux
ss takes a filter expression after the options: ss -tn 'dport = :443' lists TCP connections whose remote port is 443, ss -tn dst 10.0.0.5 lists connections to that address, and ss -tn state established '( sport = :22 )' shows established SSH sessions on a server. Quote the expression so the shell does not interpret (, ), < or >.
ss -tn 'sport = :443' # connections to my HTTPS server
ss -tn 'dport = :5432' # my outgoing connections to PostgreSQL
ss -tn dst 192.0.2.10 # everything to or from that peer
ss -tn dst 10.0.0.0/8 # peers in a CIDR range
ss -tn state established '( dport = :443 or sport = :443 )'
ss -tn 'sport > :1024 and dport = :80' # numeric comparison on portsFilter grammar
A filter is [state STATES] [EXPRESSION]. The expression is made of predicates joined by and, or and not; consecutive predicates without an operator are joined with and, and parentheses group them.
| Predicate | Matches |
|---|---|
| sport = :PORT | Local port of the socket. A service name works too: sport = :ssh. |
| dport = :PORT | Remote (peer) port. |
| src ADDRESS[/PREFIX][:PORT] | Local address, optionally with a prefix length and port. |
| dst ADDRESS[/PREFIX][:PORT] | Remote address; dst 192.0.2.10:443 combines address and port. |
| dev = eth0 | Sockets bound to that interface (name or index). |
| state established | Only that TCP state; also connected, synchronized, all, time-wait and the other state names. |
| exclude listening | Every state except the named one. |
Port comparisons accept =, !=, <, <=, >, >= and the word aliases eq, ne, lt, le, gt, ge. The word forms avoid quoting problems: ss -tn sport gt :1024.
Pitfalls
- Forgetting the colon.
dport = 443is not a port test; writedport = :443. - Unquoted parentheses or
>. The shell treats>as a redirection and creates a file named:1024. Quote the whole filter, or usegt. A malformed filter ends withss: bison bellows (while parsing filter): "syntax error!", explained in bison bellows while parsing filter. - Wrong state names.
state listenfails; the name islistening. See wrong state name. - Listening sockets are hidden by default. Add
-l(only listeners) or-a(all) when the port you filter on is a listener. - Name resolution. Without
-n, ss prints service names (https) and may resolve addresses, which is slower; filters still accept numbers either way.
Combine with other options
-p adds the owning process, -o the timers, -i the TCP internals and -H drops the header, which is handy for counting: ss -Htn state established 'sport = :443' | wc -l prints the number of open HTTPS connections. For a breakdown by state or peer see count connections by state.
FAQ
What is the difference between sport and dport?
sport is the local port of the socket and dport the remote one. On a server, connections to your web server have sport = :443; outgoing connections your machine opens to a remote HTTPS server have dport = :443.
Why do I need the colon before the port?
The port is parsed with the host syntax ADDRESS:PORT, and an empty address means any. Without the colon ss tries to read 443 as an address and the filter fails or matches nothing.
Can I filter IPv6 addresses?
Yes. Put the address in square brackets so the port separator is unambiguous, for example dst [2001:db8::1] or dst [2001:db8::1]:443, and quote the filter so the shell leaves the brackets alone.