1
00:00:00,000 --> 00:00:10,320
In this video, you'll learn how to analyze network sockets.

2
00:00:10,320 --> 00:00:12,880
A network socket is a connection endpoint,

3
00:00:12,880 --> 00:00:16,360
and it consists of an IP address followed by a port.

4
00:00:16,360 --> 00:00:22,360
So 127.0.0.1 colon 80 is the network socket

5
00:00:22,360 --> 00:00:26,959
that defines port 80 listening on local host.

6
00:00:26,959 --> 00:00:29,959
Sockets also exist as Unix sockets,

7
00:00:29,959 --> 00:00:33,080
and Unix sockets are endpoints in communication

8
00:00:33,080 --> 00:00:36,680
with services on Linux or Unix.

9
00:00:36,680 --> 00:00:40,680
SS is a standard tool to show socket information.

10
00:00:40,680 --> 00:00:45,119
It replaces the legacy net site utility.

11
00:00:45,119 --> 00:00:47,599
So SS will show all connections,

12
00:00:47,599 --> 00:00:50,040
and it can be used with a couple of parameters.

13
00:00:50,040 --> 00:00:52,599
And that can be handy to figure out

14
00:00:52,599 --> 00:00:55,880
if anything is listening on a specific socket.

15
00:00:55,880 --> 00:01:00,599
So SS-TU shows connected TCP and UDP sockets.

16
00:01:00,599 --> 00:01:04,800
SS-TUA adds sockets that are in a listening state.

17
00:01:04,800 --> 00:01:10,239
SS-TLN is showing TCP sockets in listening state

18
00:01:10,239 --> 00:01:12,720
only without resolving host names.

19
00:01:12,720 --> 00:01:17,639
And SS-DULPIN shows TCP and UDP sockets

20
00:01:17,639 --> 00:01:20,320
which are in listening state, and it adds process name

21
00:01:20,320 --> 00:01:22,000
or PID to the output.

22
00:01:22,000 --> 00:01:23,360
Let me show you.

23
00:01:23,360 --> 00:01:25,839
So here we have SS, as you can see,

24
00:01:25,839 --> 00:01:27,360
lots of information.

25
00:01:27,360 --> 00:01:30,360
Many of the items that are listed here are files.

26
00:01:30,360 --> 00:01:33,360
Pipe it to less if you want to see what exactly it is.

27
00:01:33,360 --> 00:01:35,639
So a local address can be a file,

28
00:01:35,639 --> 00:01:39,959
and a port can be associated to a file as well.

29
00:01:39,959 --> 00:01:41,360
That's the idea of sockets.

30
00:01:41,360 --> 00:01:44,720
Sockets are not uniquely about IP addresses.

31
00:01:44,720 --> 00:01:49,320
But to make it a little bit more specific, SS-TU.

32
00:01:49,320 --> 00:01:54,800
For TCP and UDP sockets, well, add an A to it,

33
00:01:54,800 --> 00:01:59,199
and you can see sockets that are in a listening state.

34
00:01:59,199 --> 00:02:03,440
And if you add an N to it, you see port numbers

35
00:02:03,440 --> 00:02:05,279
instead of port names.

36
00:02:05,279 --> 00:02:10,880
Now, what I like as well is SS-TULPN,

37
00:02:10,880 --> 00:02:14,600
where we get information about the sockets,

38
00:02:14,600 --> 00:02:17,360
but also about the listening process.

39
00:02:17,360 --> 00:02:19,600
And that's something that is often required.

40
00:02:19,600 --> 00:02:21,960
If you see an illegal socket on your system,

41
00:02:21,960 --> 00:02:23,839
you might want to terminate it.

42
00:02:23,839 --> 00:02:27,119
And then the P information is giving the related process

43
00:02:27,119 --> 00:02:28,880
and PID information,

44
00:02:28,880 --> 00:02:31,479
which allows you to easily use kill on that

45
00:02:31,479 --> 00:02:32,839
if you want to get rid of it.