added ss & updated lsof

3 files changed, 46 insertions, 0 deletions

diff --git a/src/monitor/README.md b/src/monitor/README.md
index 0a09803..baaacb9 100644
--- a/src/monitor/README.md
+++ b/src/monitor/README.md
@@ -1,6 +1,7 @@
 # Resource analysis & monitor
 
 - [lsof](./lsof.md)
+- [ss](./ss.md)
 - [pidstat](./pidstat.md)
 - [pgrep](./pgrep.md)
 - [pmap](./pmap.md)
diff --git a/src/monitor/lsof.md b/src/monitor/lsof.md
index f621abe..7effd39 100644
--- a/src/monitor/lsof.md
+++ b/src/monitor/lsof.md
@@ -55,6 +55,12 @@ Show open connections to `localhost` for `$USER`:
 lsof -a -u $USER -i @localhost
 ```
 
+## Open connection to specific port
+Show open connections to port `:1234` for `$USER`:
+```markdown
+lsof -a -u $USER -i :1234
+```
+
 ## IPv4 TCP connections in `ESTABLISHED` state
 ```markdown
 lsof -i 4TCP -s TCP:ESTABLISHED
diff --git a/src/monitor/ss.md b/src/monitor/ss.md
new file mode 100644
index 0000000..aaa27fd
--- /dev/null
+++ b/src/monitor/ss.md
@@ -0,0 +1,39 @@
+# ss(8)
+
+```markdown
+ss [option] [filter]
+```
+
+```markdown
+[option]
+  -p ..... Show process using socket
+  -l ..... Show sockets in listening state
+  -4/-6 .. Show IPv4/6 sockets
+  -x ..... Show unix sockets
+  -n ..... Show numeric ports (no resolve)
+  -O ..... Oneline output per socket
+```
+
+```markdown
+[filter]
+  dport/sport PORT .... Filter for destination/source port
+  dst/src ADDR ........ Filter for destination/source address
+
+  and/or .............. Logic operator
+  ==/!= ............... Comparison operator
+
+  (EXPR) .............. Group exprs
+```
+
+# Examples
+
+Show all tcp IPv4 sockets connecting to port `443`:
+```markdown
+ss -4 'dport 443'
+```
+
+Show all tcp IPv4 sockets that don't connect to port `443` or connect to address `1.2.3.4`.
+```markdown
+ss -4 'dport != 443 or dst 1.2.3.4'
+```
+