ss -tulnp Command
Intermediate Networking man(1)Show listening TCP/UDP ports with process info
👁 10 views
📅 Updated: Mar 15, 2026
SYNTAX
ss -tulnp
What Does ss -tulnp Do?
ss -tulnp is the most commonly used network diagnostic command in Linux. It combines flags to show all listening TCP and UDP ports with their associated process names, providing a complete picture of network services running on a system.
This command is typically the first step in network troubleshooting: checking which services are running, verifying ports are open, identifying port conflicts, and auditing network services for security.
Breaking down the flags: -t (TCP), -u (UDP), -l (listening only), -n (numerical addresses), -p (show processes). Together they answer the question: what is listening on what port?
This command is typically the first step in network troubleshooting: checking which services are running, verifying ports are open, identifying port conflicts, and auditing network services for security.
Breaking down the flags: -t (TCP), -u (UDP), -l (listening only), -n (numerical addresses), -p (show processes). Together they answer the question: what is listening on what port?
Options & Flags
| Option | Description | Example |
|---|---|---|
| -t | Show TCP sockets | ss -t |
| -u | Show UDP sockets | ss -u |
| -l | Listening sockets only | ss -l |
| -n | Numerical addresses (no DNS resolution) | ss -n |
| -p | Show process using each socket | sudo ss -p |
| -4/-6 | Show only IPv4 or IPv6 | ss -4tulnp |
Practical Examples
#1 Show all listening services
The standard command for checking open ports and services.
$ sudo ss -tulnp
Output:
Netid State Local Address:Port Process
tcp LISTEN 0.0.0.0:22 sshd
tcp LISTEN 0.0.0.0:80 nginx
tcp LISTEN 0.0.0.0:443 nginx
udp LISTEN 0.0.0.0:53 named
#2 Check specific port
Checks if MySQL is listening on port 3306.
$ sudo ss -tulnp | grep ':3306'
Output:
tcp LISTEN 0.0.0.0:3306 users:(("mysqld",pid=1234))
#3 IPv4 only
Shows only IPv4 listening ports.
$ sudo ss -4tulnp#4 Count listening ports
Counts the number of listening TCP ports.
$ ss -tln | wc -l
Output:
12
#5 Check for port conflicts
Verifies if port 8080 is already in use before starting a new service.
$ sudo ss -tulnp | grep ':8080'#6 Security audit
Shows services exposed to external networks (not just localhost).
$ sudo ss -tulnp | grep -v "127.0.0.1"Tips & Best Practices
Memorize the flags: tulnp = TCP, UDP, Listening, Numerical, Process. This is the single most useful network command to memorize.
Alternative: netstat -tulnp: The equivalent netstat command is netstat -tulnp. ss is preferred on modern systems as it is faster.
Requires root: The -p flag needs root to show all process names. Without sudo, you only see your own processes.
Frequently Asked Questions
Why do I need sudo?
The -p flag requires root privileges to show process names for services owned by other users (root, www-data, etc.).
What does 0.0.0.0 vs 127.0.0.1 mean?
0.0.0.0 means listening on all interfaces (accessible from network). 127.0.0.1 means localhost only (not accessible from outside).
How do I find what is using a specific port?
Run sudo ss -tulnp | grep ':PORT'. This shows the process name and PID using that port.
Related Commands
More Networking Commands
Master Linux with Professional eBooks
Curated IT eBooks covering Linux, DevOps, Cloud, and more
Browse Books →