ss — Inspect Socket Statistics and Network Connections

ss is the fast, modern replacement for netstat on Linux: instead of iterating through proc filesystem entries, it reads socket statistics directly from the kernel netlink interface – and returns active connections, listening ports and TCP states in milliseconds. This guide shows you how to check what is listening on your system, which process owns the socket and which connection states are currently active.

Basic Usage

ss — Show all established connections.

ss

ss -l — Show only listening sockets.

ss -l

ss -a — Show all sockets (listening and established).

ss -a

ss -s — Show socket statistics summary (total, TCP, UDP, RAW counts).

ss -s

Protocol Filters

ss -t — Show TCP connections only.

ss -t

ss -u — Show UDP sockets only.

ss -u

ss -w — Show RAW sockets only.

ss -w

ss -x — Show Unix domain sockets only.

ss -x

ss -4 — Show IPv4 sockets only.

ss -4

ss -6 — Show IPv6 sockets only.

ss -6

ss -tl — Show TCP listening sockets.

ss -tl

ss -ul — Show UDP listening sockets.

ss -ul

ss -tua — Show all TCP and UDP sockets.

ss -tua

Display Options

ss -n — Numeric output — do not resolve service names or hostnames.

ss -n

ss -p — Show process using the socket (requires root for other users' processes).

sudo ss -p

ss -e — Show extended socket information (UID, inode, cookie).

ss -e

ss -m — Show socket memory usage.

ss -m

ss -ti — Show internal TCP information (congestion, RTT, window sizes).

ss -ti

ss -to — Show timer information (keepalive, retransmit timers).

ss -to

ss -Z — Show SELinux security context.

ss -Z

Common Combinations

ss -tlnp — Show TCP listening ports with port numbers and process info. The most commonly used combination.

sudo ss -tlnp

ss -tulnp — Show all TCP and UDP listening ports with processes.

sudo ss -tulnp

ss -tanp — Show all TCP connections with port numbers and processes.

sudo ss -tanp

ss -ti — Show TCP connections with internal info (congestion window, RTT, MSS).

ss -ti

ss -tlnpe — Show listening TCP ports with process, numeric, and extended info.

sudo ss -tlnpe

Filtering by Port

ss -tln sport = :PORT — Show sockets listening on a specific port.

ss -tln sport = :80

ss -tn dport = :PORT — Show connections to a specific destination port.

ss -tn dport = :443

ss -tln sport = :PORT1 or sport = :PORT2 — Filter by multiple ports using OR.

ss -tln 'sport = :80 or sport = :443'

ss -tn sport gt :1024 — Show connections with source port greater than 1024.

ss -tn 'sport gt :1024'

ss -tn sport lt :1024 — Show connections with privileged source ports (< 1024).

ss -tn 'sport lt :1024'

Filtering by Address

ss -tn dst ADDRESS — Show connections to a specific destination address.

ss -tn dst 8.8.8.8

ss -tn src ADDRESS — Show connections from a specific source address.

ss -tn src 192.168.1.100

ss -tn dst NETWORK/CIDR — Show connections to a specific network.

ss -tn dst 10.0.0.0/8

Filtering by State

ss -t state established — Show only established TCP connections.

ss -t state established

ss -t state listening — Show only listening TCP sockets.

ss -t state listening

ss -t state time-wait — Show only TIME-WAIT connections.

ss -t state time-wait

ss -t state close-wait — Show only CLOSE-WAIT connections (may indicate application issues).

ss -t state close-wait

ss -t state fin-wait-1 — Show connections in FIN-WAIT-1 state.

ss -t state fin-wait-1

ss -t state syn-sent — Show connections in SYN-SENT state (outgoing connection attempts).

ss -t state syn-sent

ss -t state syn-recv — Show connections in SYN-RECV state (incoming connection attempts).

ss -t state syn-recv

ss -t state connected — Show all connected (non-listening) sockets.

ss -t state connected

Practical Examples

ss -tlnp | grep :80 — Check which process is listening on port 80.

sudo ss -tlnp | grep :80

ss -tn state established | wc -l — Count the number of established TCP connections.

ss -tn state established | wc -l

ss -tn state established dst :443 | wc -l — Count established HTTPS connections.

ss -tn state established dst :443 | wc -l

ss -tn | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -rn | head — Show top 10 remote IPs by connection count.

ss -tn | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -rn | head

ss -t state time-wait | wc -l — Count TIME-WAIT connections (high numbers may indicate connection churn).

ss -t state time-wait | wc -l

watch -n 1 'ss -s' — Continuously monitor socket statistics.

watch -n 1 'ss -s'

ss -tnp | grep ssh — Find all SSH connections.

ss -tnp | grep ssh

ss -lnp | grep -E ':(80|443|8080|8443) ' — Check all common web server ports.

sudo ss -lnp | grep -E ':(80|443|8080|8443) '

Conclusion

ss has definitively replaced netstat on modern Linux systems – with direct kernel access, expressive filter syntax and significantly shorter response times. For day-to-day work sudo ss -tlnp is usually enough to see what is listening and where; for diagnosis -i gives you deep insight into TCP internals that netstat never offered.