ss

Updated

September 4, 2026

Overview

ss (socket statistics) inspects TCP/UDP/UNIX sockets. It replaces most netstat workflows and is faster on busy systems because it talks to the kernel more efficiently. First stop for “what is listening?” and “who is connected?”.

Syntax

ss [options] [filter]

Common Options

Option Description
-t / -u / -x TCP / UDP / UNIX
-l Listening only
-a All (listen + connected)
-n Numeric hosts/ports (no DNS)
-p Owning process (often needs root)
-e Extended detail
-m Socket memory info
-s Summary counters
-4 / -6 Address family
-o Timer info (retransmit, keepalive)
-K Kill socket (privileged; careful)
-H Suppress header (newer ss)

Key Use Cases

  1. See listeners and bound ports
  2. Map sockets to PIDs/processes
  3. Find connections to/from a host or port
  4. Spot TIME-WAIT piles and backlog issues

Examples with Explanations

Listening TCP with processes

sudo ss -lntp

-n avoids reverse DNS delays; -p shows users:(("nginx",pid=…)).

Established connections

ss -tnp
ss -tnp state established

Filter by port

sudo ss -lntp '( sport = :22 )'
sudo ss -lntp '( sport = :8080 )'
ss -tnp '( dport = :443 or sport = :443 )'

Quote filters so the shell does not eat parentheses.

Filter by address

ss -tn dst 1.1.1.1
ss -tn src 10.0.0.0/8

UDP listeners

sudo ss -lunp

DNS, NTP, QUIC-related services often show here.

Summary and states

ss -s
ss -ant | awk 'NR>1 {c[$1]++} END {for (s in c) print c[s], s}' | sort -nr

High TIME-WAIT can be normal after load; runaway SYN-RECV may mean flood or backlog misconfig.

UNIX domain sockets

sudo ss -xlp | head
ss -x src /run/systemd/private

Local IPC for docker/podman/systemd often appears as UNIX sockets.

“What owns this port?”

sudo ss -lntp | grep -E ':8080\b'
# or filter expression:
sudo ss -lntp '( sport = :8080 )'
sudo lsof -iTCP:8080 -sTCP:LISTEN

IPv6 only

sudo ss -lntp -6

Understanding Output

Typical columns: state (LISTEN, ESTAB, TIME-WAIT, …), receive/send queues, local address:port, peer address:port, process. Queue columns matter when diagnosing overload (apps not accept()ing fast enough).

Notes & Pitfalls

  • Without sudo, -p may omit other users’ processes.
  • netstat still appears in old docs; install iproute2 (ss) as the default.
  • Filters use a small language — see man ss “FILTER”.
  • For payload inspection use tcpdump/wireshark, not ss.

Additional Resources

  • man ss