ss: wrong state name: listen
- tool
- ss / netstat
- exit code
- 255
- versions
- iproute2 5.x, iproute2 6.x
- os
- linux
ss: wrong state name: listen means the word after state (or exclude) is not one of the names ss knows. ss uses lowercase names with hyphens (time-wait, close-wait, syn-sent), not the netstat spellings (TIME_WAIT), and the listening state is called listening, not listen. Matching is case-insensitive, so the problem is the spelling, not upper case. For listening sockets, ss -l is the usual form.
Valid state names
The list below comes from scan_state() in iproute2's misc/ss.c:
| Name to use | TCP state | Common wrong forms |
|---|---|---|
| established | ESTABLISHED | estab (ss prints ESTAB, but the filter needs established) |
| syn-sent | SYN_SENT | syn_sent |
| syn-recv (or syn-rcv) | SYN_RECV | syn_recv |
| fin-wait-1, fin-wait-2 | FIN_WAIT1, FIN_WAIT2 | fin_wait1 |
| time-wait | TIME_WAIT | time_wait, timewait |
| close-wait | CLOSE_WAIT | close_wait |
| last-ack | LAST_ACK | last_ack |
| closing | CLOSING | |
| listening | LISTEN | listen |
| closed (or close, unconnected) | CLOSE | |
| bound-inactive | bound but inactive sockets (recent kernels) |
Group names: all, connected (all except listening and closed), synchronized (connected except syn-sent), bucket (syn-recv and time-wait, the minisocket states), big (all except bucket states).
Correct commands
ss -tn state established
ss -tn state time-wait '( dport = :443 )'
ss -tn state close-wait
ss -tln # listening TCP sockets
ss -tn exclude established # everything except establishedstate can be repeated (state fin-wait-1 state fin-wait-2). ss exits with status 255 on this error and prints nothing else.