ss
Overview
ss (socket statistics) inspects TCP/UDP/UNIX sockets. It is the modern replacement for most netstat use cases and is faster on busy systems.
Syntax
ss [options] [filter]Common Options
| Option | Description |
|---|---|
-t / -u / -x |
TCP / UDP / UNIX |
-l |
Listening sockets |
-a |
All (listen + established) |
-n |
Numeric hosts/ports (no resolve) |
-p |
Process that owns the socket |
-e |
Extended detail |
-m |
Socket memory |
-s |
Summary statistics |
-4 / -6 |
Address family |
-H |
Suppress header (newer) |
-o |
Timer info |
Key Use Cases
- See what is listening and on which port
- Find connections to/from a host
- Map sockets to PIDs/processes
- Diagnose TIME-WAIT / backlog issues
Examples with Explanations
Listening TCP with processes
sudo ss -lntp-p usually needs root for other users’ processes.
Established connections
ss -tnpFilter by port
ss -lntp '( sport = :22 )'
ss -tnp '( dport = :443 or sport = :443 )'Filter by destination
ss -tn dst 1.1.1.1UDP listeners
sudo ss -lunpSummary
ss -sUNIX domain sockets
ss -xlp | headUnderstanding Output
Columns typically include state (LISTEN, ESTAB), local/peer addresses, and process (users:(("nginx",pid=…,fd=…))). Prefer -n in scripts for stable output.
Common Usage Patterns
“What owns port 8080?”
sudo ss -lntp | grep ':8080'
# or
sudo ss -lntp '( sport = :8080 )'Count connections per state
ss -ant | awk 'NR>1 {print $1}' | sort | uniq -c | sort -nrNotes & Pitfalls
- Filters use a small language; quote them for the shell.
netstatis still found on some systems but often vianet-toolslegacy package.
- For packet capture use
tcpdump/wireshark, notss.
Additional Resources
man ss