ss -l shows all sockets (same as -a) instead of listening only #81

Version: iproute2mac v1.7.5 (Homebrew, macOS, Apple Silicon).

ss -l prints every socket (ESTAB, SYN_SENT, ...) rather than only listening ones. With iproute2's ss,
-l/--listening restricts the output to LISTEN sockets, and -a is what shows both.

Repro:

$ ss -l | head -4
Netid   State     Recv-Q  Send-Q  Local Address:Port      Peer Address:Port
tcp4    ESTAB     0       0       100.64.0.3:22           100.64.0.1:51974
tcp6    SYN_SENT  0       0       fe80::a4cd:76bf::1024   fe80::719b:c693::1024
tcp6    SYN_SENT  0       0       fe80::c878:896:f:1024   fe80::7614:a0e3::1024

Expected (Linux iproute2): only rows in state LISTEN.

Where it comes from, as far as I can tell: src/ss.py passes include_listening=args.all or args.listening
to parse_netstat, and the only state filter there is if not include_listening and state == "LISTEN": continue.
So -l adds LISTEN rows to the default set instead of restricting to them, which makes -l identical to -a.

Impact: a script that does ss -lntp | grep -c ':9471' to detect a listener counts an outbound ESTABLISHED
connection to a remote :9471 as a local server. That is how I found it.