-h
--help Show summary of options.
| -V
--version Output version information.
| -H
--no-header Suppress header line.
| -n
--numeric Do not try to resolve service names.
| -r
--resolve resolve numeric address/ports.
| -a
--all Display both listening and non-listening
(for TCP this means established connections) sockets.
| -l
--listening Display only listening sockets (these are omitted by default).
| -o
--options Show timer information.
| -e
--extended Show detailed socket information
| -m
--memory Show socket memory usage.
| -p
--processes Show process using socket.
| -i
--info Show internal TCP information.
| -K
--kill
Forcibly close sockets, displays sockets that are successfully closed and silently
skips those that the kernel does not support closing. Only for IPv4 and IPv6 socket.
| -s
--summary
Display summary statistics. Does not parse socket lists obtaining summary from various sources.
Useful when amount of sockets is so huge that parsing /proc/net/tcp is painful.
| -Z
--context
As the -p option but also shows process security context.
For netlink(7) sockets the initiating process context is displayed as follows:
- If valid pid show the process context.
- If destination is kernel (pid = 0) show kernel initial context.
- If a unique identifier has been allocated by the kernel or netlink user, show context as
"unavailable". This will generally indicate that a process has more than one netlink socket
active.
| -z
--contexts
As -Z also shows the socket context taken from the associated inode
and is not the actual socket context held by the kernel. Sockets are typically labeled with the context of
the creating process, however the context shown will reflect any policy role, type and/or range transition
rules applied, and is therefore a useful reference.
| -N NSNAME
--net=NSNAME
Switch to the specified network namespace name.
| | [; Display
| -b
--bpf socket BPF filters (only administrators are allowed to get these information).
| -4
--ipv4 only IP version 4 sockets (alias for | -f inet).
-6
--ipv6 only IP version 6 sockets (alias for | -f inet6).
-0
--packet PACKET sockets (alias for | -f link).
-t
--tcp TCP sockets.
| -u
--udp UDP sockets.
| -d
--dccp DCCP sockets.
| -w
--raw RAW sockets.
| -x
--unix Unix domain sockets (alias for | -f unix).
-S
--sctp SCTP sockets.
| -f FAMILY
--family=FAMILY Display sockets of type FAMILY. :
unix, inet, inet6, link, netlink.
| -A QUERY
--queryQUERY
--socket=QUERy
List of socket tables to dump, separated by commas. The following identifiers are understood: all, inet,
tcp, udp, raw, unix, packet, netlink, unix_dgram, unix_stream, unix_seqpacket, packet_raw, packet_dgram.
| -D FILE
--diag=FILE
Dump raw information about TCP sockets to FILE after applying filters. If FILE
is> - stdout is used.
| -F FILE
--filter=FILE
Read filter information from FILE.
Each line is interpreted like single command line option.
If "- stdin is used.
FILTER := [ state STATE-FILTER ] [ EXPRESSION <>i>]
Check the official documentation (Debian package iproute-doc) for details regarding filters.
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |