shadowsocks-libev/doc/index.md

\mainpage shadowsocks-c CLI reference

Command-line reference and configuration guide, generated by Doxygen from the source documentation.

• \ref ss-local "ss-local: SOCKS5 client"
• \ref ss-server "ss-server: proxy server"
• \ref ss-tunnel "ss-tunnel: local port forwarding"
• \ref ss-redir "ss-redir: transparent proxy"
• \ref ss-manager "ss-manager: multi-user management"
• \ref ss-nat "ss-nat: NAT setup helper"
• \ref shadowsocks-c "Configuration, examples, and management protocol"

Download the generated man pages from the published site. The archive includes the six CLI manuals and both overview lookup names.

\section cli_conventions CLI conventions

Use descriptive long flags or their existing short aliases. Connections use different names for the remote server and the local listener:

• Clients: --server HOST:PORT selects the remote Shadowsocks server. IPv6 endpoints must use brackets, for example --server '[2001:db8::1]:8388' or --server '[fe80::1%eth0]:8388'. Bare IPv6 remains a host-only address. Repeat --server for multiple endpoints, each with its own port. The legacy --server-port / -p and configured server port are fallbacks only; embedded ports always win. SIP003 plugins require all endpoints to share one port.
• Listeners: --listen-address ADDRESS --listen-port PORT controls where a client or server accepts connections. The manager uses --manager-address for its control socket and configuration or its API for individual server ports.
• Tunnels: --destination HOST:PORT selects the forwarding destination.
• Configuration: --config FILE, --cipher NAME, and --password SECRET map to -c, -m, and -k. AEAD-2022 keys can also be supplied with --key BASE64.

Explicit transport and address-family flags override the JSON configuration. The last transport flag (--tcp-only, --udp, or --udp-only) wins, as does the last address preference (--ipv4-first or --ipv6-first). Address preferences do not disable either IP family. Other options retain their existing semantics, including repeatable server addresses and ss-local --server-url imports. Zero-valued resource settings such as MTU and TCP buffer sizes retain their existing behavior: they fall back to the configured value, or the system default when none is configured.

--help and --version write to standard output and exit successfully. Unknown options, missing values, invalid numeric CLI values, and unexpected positional arguments write usage errors to standard error and exit with status 2.

The formerly ignored -l flag in ss-server and ss-manager is now an error. Use ss-server --listen-port instead; manager-controlled ports come from its configuration or API. The removed one-time-authentication flag -A remains an error. Use an AEAD cipher.