/errors/ss/bison-bellows-while-parsing-filter
ss: bison bellows (while parsing filter): "syntax error!"
- tool
- ss / netstat
- exit code
- 255
- versions
- iproute2 5.x, iproute2 6.x
- os
- linux
ss: bison bellows (while parsing filter): "syntax error!" is how ss reports a grammar error in its filter expression (the part after the options, such as dport = :443). The filter parser is generated with bison, hence the wording. The filter is incomplete or malformed: an operator without a value, unbalanced parentheses, a trailing and/or, or a comparison that the keyword does not support. Quote the whole filter and write each condition in full: ss -tn '( dport = :443 or sport = :443 )'.
The message has no trailing newline, so the usage text that ss prints next starts on the same line (..."syntax error!"Usage: ss [ OPTIONS ]), and ss exits with status 255.
Filter syntax that works
ss -tn dport = :443
ss -tn '( dport = :443 or dport = :80 )'
ss -tn 'sport = :22 and dst 192.0.2.0/24'
ss -tn 'not dport = :22'
ss -tn 'dport > :1024'
ss -tln 'sport = :8080'
ss -tn dev eth0What the grammar in misc/ssfilter.y accepts:
| Element | Accepted forms |
|---|---|
| Keywords | src, dst, sport, dport, dev, fwmark, cgroup, autobound |
| Equality | = == eq, and != ne neq (the = can be omitted: dport :443) |
| Port comparisons | < lt, > gt, <= le leq, >= ge geq (only after sport or dport) |
| Logic | and & &&, or | ||, not !; two conditions side by side mean and |
| Grouping | ( and ) as separate words |
Other filter errors
ss splits each argument at spaces and treats any word it does not recognise as an address or port. A misspelled keyword (port = :22, dprot) or a parenthesis glued to a word ((dport) therefore does not cause the bison message but, unless the word happens to resolve as a host name, an address error such as Error: an inet prefix is expected rather than "port". followed by Cannot parse dst/src address. (exit status 1).
Why quoting matters
Without quotes, ss -tn ( dport = :443 ) fails in the shell itself (syntax error near unexpected token), and ss -tn \( dport = :443 \) works but is easy to get wrong. Single quotes pass the filter to ss exactly as written. In scripts, a filter can also be read from a file with ss -F FILE, which avoids shell quoting entirely.