\mainpage shadowsocks-c CLI reference

Command-line reference and configuration guide, generated by Doxygen from the
source documentation.

- \ref ss-local "ss-local: SOCKS5 client"
- \ref ss-server "ss-server: proxy server"
- \ref ss-tunnel "ss-tunnel: local port forwarding"
- \ref ss-redir "ss-redir: transparent proxy"
- \ref ss-manager "ss-manager: multi-user management"
- \ref ss-nat "ss-nat: NAT setup helper"
- \ref shadowsocks-c "Configuration, examples, and management protocol"

[Download the generated man pages](https://shadowsocks.github.io/shadowsocks-c/man-pages.tar.gz)
from the published site. The archive includes the six CLI manuals and both
overview lookup names.

\section cli_conventions CLI conventions

Use descriptive long flags or their existing short aliases. Connections use
different names for the remote server and the local listener:

- Clients: `--server HOST:PORT` selects the remote Shadowsocks server.
  IPv6 endpoints must use brackets, for example `--server '[2001:db8::1]:8388'`
  or `--server '[fe80::1%eth0]:8388'`. Bare IPv6 remains a host-only address.
  Repeat `--server` for multiple endpoints, each with its own port. The legacy
  `--server-port` / `-p` and configured server port are fallbacks only; embedded
  ports always win. SIP003 plugins require all endpoints to share one port.
- Listeners: `--listen-address ADDRESS --listen-port PORT` controls where a client
  or server accepts connections. The manager uses `--manager-address` for its
  control socket and configuration or its API for individual server ports.
- Tunnels: `--destination HOST:PORT` selects the forwarding destination.
- Configuration: `--config FILE`, `--cipher NAME`, and `--password SECRET` map to
  `-c`, `-m`, and `-k`. AEAD-2022 keys can also be supplied with `--key BASE64`.

Explicit transport and address-family flags override the JSON configuration.
The last transport flag
(`--tcp-only`, `--udp`, or `--udp-only`) wins, as does the last address preference
(`--ipv4-first` or `--ipv6-first`). Address preferences do not disable either IP
family. Other options retain their existing semantics, including repeatable
server addresses and `ss-local --server-url` imports. Zero-valued resource
settings such as MTU and TCP buffer sizes retain their existing behavior: they
fall back to the configured value, or the system default when none is configured.

`--help` and `--version` write to standard output and exit successfully. Unknown
options, missing values, invalid numeric CLI values, and unexpected positional
arguments write usage errors to standard error and exit with status 2.

The formerly ignored `-l` flag in `ss-server` and `ss-manager` is now an error.
Use `ss-server --listen-port` instead; manager-controlled ports come from its
configuration or API. The removed one-time-authentication flag `-A` remains an
error. Use an AEAD cipher.