ss

Overview

The ss (Socket Statistics) command is a modern replacement for netstat. It displays socket statistics and can show more TCP and state information than other tools.

Syntax

ss [options] [filter]

Common Options

Option	Description
`-n`	Don’t resolve names
`-a`	All sockets
`-l`	Listening sockets
`-p`	Show processes
`-t`	TCP sockets
`-u`	UDP sockets
`-x`	Unix sockets
`-4`	IPv4 only
`-6`	IPv6 only
`-r`	Resolve names
`-m`	Memory usage
`-o`	Timer info

Socket States

State	Description
ESTAB	Established
LISTEN	Listening
TIME-WAIT	Time wait
CLOSE-WAIT	Close wait
SYN-SENT	Connection attempt
SYN-RECV	Connection request
FIN-WAIT-1	Connection closed
FIN-WAIT-2	Connection closed
LAST-ACK	Acknowledgment wait
CLOSING	Both sides closed

Key Use Cases

Socket monitoring
Connection tracking
Network debugging
Performance analysis
Security auditing

Examples with Explanations

Example 1: Listening Ports

ss -tulpn

Show TCP/UDP listeners

Example 2: Established

ss -o state established

Show active connections

Example 3: Process Info

ss -tp

Show with process names

Common Usage Patterns

Check listeners:
```
ss -l
```
Memory stats:
```
ss -m
```
Filter state:
```
ss state time-wait
```

Additional Resources

Best Practices

Use filters
Check states
Monitor memory
Track processes
Document findings

Security Considerations

Port exposure
Process verification
Connection states
Resource usage
Information exposure

Troubleshooting

Connection issues
Memory problems
Process tracking
State transitions
Resource limits

Filter Examples

By port:
```
ss sport = :80
```
By address:
```
ss dst 192.168.1.1
```
By state:
```
ss state listening
```