ss Command
Intermediate Networking man(1)Show socket statistics (modern replacement for netstat)
👁 9 views
📅 Updated: Mar 15, 2026
SYNTAX
ss [OPTION]... [FILTER]
What Does ss Do?
ss (socket statistics) is the modern replacement for netstat, providing faster and more detailed network socket information. It is part of the iproute2 package and is the recommended tool for inspecting network connections.
ss can display TCP, UDP, Unix, and raw socket information. It supports powerful filtering by state, address, port, and process, making it ideal for troubleshooting network issues on busy servers.
ss queries the kernel directly using netlink, making it significantly faster than netstat on systems with many connections. It also provides more detailed TCP state information including congestion window, RTT, and buffer sizes.
ss can display TCP, UDP, Unix, and raw socket information. It supports powerful filtering by state, address, port, and process, making it ideal for troubleshooting network issues on busy servers.
ss queries the kernel directly using netlink, making it significantly faster than netstat on systems with many connections. It also provides more detailed TCP state information including congestion window, RTT, and buffer sizes.
Options & Flags
| Option | Description | Example |
|---|---|---|
| -t | Show TCP sockets | ss -t |
| -u | Show UDP sockets | ss -u |
| -l | Show listening sockets only | ss -l |
| -n | Show numerical addresses | ss -n |
| -p | Show process using socket | sudo ss -p |
| -a | Show all sockets (listening and non-listening) | ss -a |
| -s | Show socket statistics summary | ss -s |
| -i | Show internal TCP information | ss -ti |
| -o | Show timer information | ss -to |
Practical Examples
#1 Show listening ports
Shows all listening TCP/UDP ports with process names — the most common usage.
$ sudo ss -tulnp
Output:
Netid State Local Address:Port Process
tcp LISTEN 0.0.0.0:22 users:(("sshd",pid=1234))
tcp LISTEN 0.0.0.0:443 users:(("nginx",pid=5678))
#2 Socket statistics summary
Quick overview of all socket types and their states.
$ ss -s
Output:
Total: 234\nTCP: 156 (estab 89, closed 12, orphaned 0)
#3 Filter by port
Shows only connections on port 443.
$ ss -tlnp sport = :443#4 Show established connections
Shows only currently established TCP connections.
$ ss -tn state established#5 Find process on specific port
Identifies what process is listening on port 80.
$ sudo ss -tlnp | grep ':80'#6 Show connection details
Shows detailed TCP internal state including RTT, window size, and congestion info.
$ ss -tiTips & Best Practices
ss filtering syntax: ss supports powerful filters: ss -tn 'sport = :80 or sport = :443' shows connections on web ports. Use state filters: ss -t state established.
ss vs netstat: ss is faster (reads kernel directly), shows more details, and supports advanced filtering. netstat parses /proc. Always prefer ss on modern systems.
Root for process info: Like netstat, ss -p requires root to show processes owned by other users. Use sudo.
Frequently Asked Questions
How do I check which ports are listening?
Use sudo ss -tulnp. It shows all listening TCP (-t) and UDP (-u) ports with process names (-p).
What is the difference between ss and netstat?
ss is faster, more feature-rich, and the modern standard. netstat is deprecated. ss queries the kernel directly via netlink while netstat parses /proc files.
How do I filter ss output by port?
Use ss -tn sport = :PORT or grep: ss -tlnp | grep ':80'. ss supports rich filtering: ss -tn 'dport = :443'.
Related Commands
More Networking Commands
Master Linux with Professional eBooks
Curated IT eBooks covering Linux, DevOps, Cloud, and more
Browse Books →