SS-SERVER(1)

💅 ss-server(1) — the Shadowsocks-libev Manual, but make it make sense 🎀

okay so bestie, you're looking at the ss-server page out of the Shadowsocks-libev Manual, and I promise it's not as scary as it looks. Grab a drink, we're doing this together 🫶

✨ NAME ✨

ss-server — the shadowsocks server, libev port. that's the whole vibe. it's the server. it serves. she's serving 💅

🌸 SYNOPSIS 🌸

ss-server [-uUv] [-h|--help] [-s <server_host>] [-p <server_port>] [-l
<local_port>] [-k <password>] [-m <encrypt_method>] [-f <pid_file>] [-t
<timeout>] [-c <config_file>] [-i <interface>] [-a <user_name>] [-d <addr>]
[-n <nofile>] [-b <local_address>] [--fast-open] [--reuse-port] [--mptcp]
[--acl <acl_config>] [--mtu <MTU>] [--no-delay] [--manager-address
<path_to_unix_domain>] [--plugin <plugin_name>] [--plugin-opts
<plugin_options>] [--password <password>] [--key <key_in_base64>]

yes it's a lot of brackets. no you don't need all of them. breathe 💖

🦋 DESCRIPTION 🦋

So. Shadowsocks-libev is a lightweight and secure socks5 proxy — like, it's the whole package, no cap. It's a port of the original shadowsocks created by clowwindy, and honestly, iconic lineage.

Shadowsocks-libev is written in pure C and takes advantage of libev to achieve both high performance and low resource consumption. high performance AND low resources? she's literally doing both. main character energy fr fr 🔥

Shadowsocks-libev consists of five components. ss-server(1) runs on a remote server to provide the secured tunnel service — that's our girl, that's who this page is about 👑. For more information, check out shadowsocks-libev(8).

---

💜 OPTIONS 💜

okay so here's the full menu, no skipping, we're reading the whole thing together:

• -s <server_host> — sets the server's hostname or IP. who she is, where she lives 🏠
• -p <server_port> — sets the server's port number. the door she answers at 🚪
• -k <password>, --password <password> — sets the password. the server and the client should use the same password — matching, always, no exceptions, that's the whole point bestie 🔑
• --key <key_in_base64> — sets the key directly. the key should be encoded with URL-safe Base64. note that it's URL-safe, okay, put the regular Base64 down 🙈
• -m <encrypt_method> — sets the cipher.

Shadowsocks-libev accepts 19 different ciphers:

aes-128-gcm, aes-192-gcm, aes-256-gcm, rc4-md5, aes-128-cfb,
aes-192-cfb, aes-256-cfb, aes-128-ctr, aes-192-ctr, aes-256-ctr,
bf-cfb, camellia-128-cfb, camellia-192-cfb, camellia-256-cfb,
chacha20-ietf-poly1305, xchacha20-ietf-poly1305, salsa20, chacha20
and chacha20-ietf.

real talk: if built with PolarSSL or custom OpenSSL libraries, some of these ciphers may not work. not a skill issue, just a build issue 💀

• -a <user_name> — run as a specific user.
• -f <pid_file> — start shadowsocks as a daemon with a specific pid file. she's going in the background, she's mysterious, she has a pid file 🎀
• -t <timeout> — sets the socket timeout in seconds. the default value is 60. so if you don't say anything, it's 60, that's the vibe ⏱️
• -c <config_file> — use a configuration file. refer to shadowsocks-libev(8) CONFIG FILE section for more details — go read it, i'll wait 📖
• -n <number> — specify max number of open files. only available on Linux. linux girlies only 🐧
• -i <interface> — send traffic through a specific network interface. okay example time: say there are three interfaces in your device — lo (127.0.0.1), eth0 (192.168.0.1) and eth1 (192.168.0.2). meanwhile you configure ss-server to listen on 0.0.0.0:8388 and bind to eth1. that results the traffic go out through eth1, but not lo nor eth0. this option is useful to control traffic in multi-interface environment. very much a "know your network" moment 🌈
• -b <local_address> — specify the local address to use while this server is making outbound connections to remote servers on behalf of the clients. she's representing, she's got a return address 🫶
• -u — enable UDP relay.
• -U — enable UDP relay and disable TCP relay. it's UDP-only, she said pick a lane ✨
• -6 — resolve hostname to IPv6 address first. v6 girlies rise 🦋
• -d <addr> — setup name servers for the internal DNS resolver (libc-ares). the default server is fetched from /etc/resolv.conf. so if you say nothing, it reads that file, periodt.
• --fast-open — enable TCP fast open. only available with Linux kernel > 3.7.0. check your kernel first bestie, don't embarrass yourself 💀
• --reuse-port — enable port reuse. only available with Linux kernel > 3.9.0. yes, a different version threshold. read carefully.
• --no-delay — enable TCP_NODELAY.
• --tcp-incoming-sndbuf <size> — set TCP send buffer size for incoming connections.
• --tcp-incoming-rcvbuf <size> — set TCP receive buffer size for incoming connections.
• --tcp-outgoing-sndbuf <size> — set TCP send buffer size for outgoing connections.
• --tcp-outgoing-rcvbuf <size> — set TCP receive buffer size for outgoing connections. (yes, all four of them, in this order, sndbuf/rcvbuf split by incoming/outgoing. iykyk 🎀)
• --acl <acl_config> — enable ACL (Access Control List) and specify config file. access control, we love boundaries 💅
• --manager-address <path_to_unix_domain> — specify UNIX domain socket address for the communication between ss-manager(1) and ss-server(1). only available in server and manager mode.
• --mtu <MTU> — specify the MTU of your network interface.
• --mptcp — enable Multipath TCP. only available with an MPTCP-enabled Linux kernel. two paths? she's multitasking. lowkey obsessed 🌸
• --plugin <plugin_name> — enable SIP003 plugin. (Experimental — noted, don't come for me 🙈)
• --plugin-opts <plugin_options> — set SIP003 plugin options. (Experimental too, same disclaimer 💀)
• -v — enable verbose mode. she's gonna talk. a lot. 🗣️
• -h|--help — print help message. the "girl just tell me" option 🫶

---

⭐ EXAMPLE ⭐

okay this is the part where i tell you the move. it is recommended to use a config file when starting ss-server(1). yes, recommended. yes, you should. no, the 47 flags are not it.

The config file is written in JSON and is easy to edit. Check out the SEE ALSO section for the default path of the config file 👀

# Start the ss-server
ss-server -c /etc/shadowsocks-libev/config.json

that's it. that's the whole command. she's gorgeous 💖

🌈 INCOMPATIBILITY 🌈

⚠️ heads up, this is the "things are different, don't @ me" section:

The config file of shadowsocks-libev(8) is slightly different from original shadowsocks. so if you're porting something over, expect a little friction, ngl.

In order to listen to both IPv4/IPv6 address, use the following grammar in your config json file:

{
"server":["::0","0.0.0.0"],
...
}

see? two entries in the array. both. at once. balanced, as all things should be ⚖️

ss-server(1) also does not understand "port_password" field in config file. so don't put it there and then act surprised 💀 If you want to start up multiple server instances with a single config file, please try the ss-manager tool. See ss-manager(8) for details. she's the one built for that, let her cook 👑

🎀 SEE ALSO 🎀

the whole friend group, plus some honoured guests:

ss-local(1), ss-tunnel(1), ss-redir(1), ss-manager(1), shadowsocks-libev(8), iptables(8), /etc/shadowsocks-libev/config.json

---

and that's the page, bestie 🫶 go forth and serve. this was Shadowsocks-libev 3.3.6, dated 10/11/2026 — mwah, slay, periodt 💅✨🍓