List outgoing connections.
List outbound connections where the port of the source address was automatically allocated.
$ ss --no-header --numeric --tcp state established "( autobound )"
0 0 192.168.8.168:55388 151.101.130.114:443 0 0 192.168.8.168:35856 34.98.64.218:443 0 0 108.102.106.106:59840 108.162.108.19:8000 0 0 192.168.8.168:51844 192.109.244.113:443 0 0 192.168.8.168:43660 173.194.222.188:5228 0 0 192.168.8.168:52222 18.157.173.201:80 0 0 108.102.106.106:57292 108.162.108.19:8000 0 0 192.168.8.168:40822 23.206.90.80:443 0 0 192.168.8.168:45118 2.16.172.41:443 0 0 192.168.8.168:36968 91.216.191.100:443 0 0 192.168.8.168:54580 34.98.64.218:443 0 0 192.168.8.168:45700 151.101.2.114:443 0 0 127.0.0.1:59650 127.0.0.1:22 0 0 192.168.8.168:52774 34.229.201.48:443 0 0 192.168.8.168:33152 192.168.8.165:22 0 0 108.102.106.106:43218 108.112.10.118:443 0 0 192.168.8.168:51984 69.173.144.139:443 0 0 108.102.106.106:43226 108.112.10.118:443 0 0 108.102.106.106:55342 100.114.143.77:3000 0 0 192.168.8.168:34848 193.0.160.130:443
Pretty-print outbound connections using the same method.
$ (echo -e "Host\tPort\tConnections\n"; ss --no-header --numeric --tcp state established "( autobound )" | awk '{c[$4]++} END{for(l in c) { printf "%s\t%s\n",l,c[l]} }' | tr ':' '\t' | sort --numeric-sort --key 3 --reverse) | column -t
Host Port Connections 34.98.64.218 443 2 108.112.10.118 443 2 108.162.108.19 8000 2 91.216.191.100 443 1 69.173.144.139 443 1 34.229.201.48 443 1 23.206.90.80 443 1 2.16.172.41 443 1 193.0.160.130 443 1 192.168.8.165 22 1 192.109.244.113 443 1 18.157.173.201 80 1 173.194.222.188 5228 1 151.101.2.114 443 1 151.101.130.114 443 1 127.0.0.1 22 1 100.114.143.77 3000 1
You can use a more thoughtful filter.
$ echo "( ( $(ip --json address | jq --raw-output '.[].addr_info | .[] | .local' | paste -s | sed -e 's/\([0-9a-f.:]\+\)/( src [\1] \&\& ! dst [\1] )/g' -e 's/\t/ || /g') ) and sport > 1024 )" ( ( ( src [127.0.0.1] && ! dst [127.0.0.1] ) || ( src [192.168.8.168] && ! dst [192.168.8.168] ) || ( src [108.102.106.106] && ! dst [108.102.106.106] ) ) and sport > 1024 )
$ (echo -e "Host\tPort\tConnections\n"; ss --no-header --numeric --tcp state established "( ( $(ip --json address | jq --raw-output '.[].addr_info | .[] | .local' | paste -s | sed -e 's/\([0-9a-f.:]\+\)/( src [\1] \&\& ! dst [\1] )/g' -e 's/\t/ || /g') ) and sport > 1024 )" | awk '{c[$4]++} END{for(l in c) { printf "%s\t%s\n",l,c[l]} }' | tr ':' '\t' | sort --numeric-sort --key 3 --reverse) | column -t
Host Port Connections 108.112.10.118 443 2 91.216.191.100 443 1 34.229.201.48 443 1 216.58.215.78 443 1 192.168.8.165 22 1 192.109.244.113 443 1 185.199.109.133 443 1 18.157.173.201 80 1 173.194.222.188 5228 1 142.250.203.195 443 1 100.114.143.77 3000 1
Simple as that.
