Example 1
Display All Sockets
$ ss -a
Netid State Recv-Q Send-Q Local Address:Port Peer Address:Port
tcp LISTEN 0 128 0.0.0.0:22 0.0.0.0:*
tcp ESTAB 0 0 192.168.1.5:22 192.168.1.100:54321
Shows all sockets (both listening and established connections) using the '-a' option. This is the most comprehensive view and includes TCP, UDP, and Unix sockets. The ss command is the modern replacement for netstat and is much faster.
Note: ss is faster than netstat because it gets information directly from kernel space
Example 2
Display Only TCP Sockets
$ ss -t
State Recv-Q Send-Q Local Address:Port Peer Address:Port
ESTAB 0 0 192.168.1.5:ssh 192.168.1.100:54321
ESTAB 0 0 192.168.1.5:http 192.168.1.101:48392
Filters output to show only TCP connections using the '-t' option. By default, this shows established connections only. TCP is the most common protocol for network services like web servers, SSH, and databases.
Combine Options: Use -ta to show all TCP sockets including listening
Example 3
Display Only UDP Sockets
$ ss -u
State Recv-Q Send-Q Local Address:Port Peer Address:Port
UNCONN 0 0 0.0.0.0:68 0.0.0.0:*
UNCONN 0 0 127.0.0.1:323 0.0.0.0:*
Shows only UDP connections with the '-u' option. UDP is a connectionless protocol used by DNS, DHCP, and many streaming applications. UDP sockets typically show as UNCONN (unconnected).
UDP Nature: UDP is connectionless, so sockets don't have traditional connection states
Example 4
Display Listening Sockets Only
$ ss -l
Netid State Recv-Q Send-Q Local Address:Port Peer Address:Port
tcp LISTEN 0 128 0.0.0.0:ssh 0.0.0.0:*
tcp LISTEN 0 128 0.0.0.0:http 0.0.0.0:*
tcp LISTEN 0 100 127.0.0.1:smtp 0.0.0.0:*
Shows only listening sockets using the '-l' option. These are services waiting for incoming connections. Critical for verifying which services are running and on which ports. Essential for security audits.
Security Check: Use this to identify unexpected listening services
Example 5
Show Process Information
$ ss -p
tcp ESTAB 0 0 192.168.1.5:22 192.168.1.100:54321 users:(("sshd",pid=1234,fd=3))
tcp LISTEN 0 128 0.0.0.0:80 0.0.0.0:* users:(("nginx",pid=5678,fd=6))
Displays the process name and PID that owns each socket using the '-p' option. Extremely useful for identifying which application is using a particular port or connection. May require root privileges for all processes.
Root Access: Run with sudo to see all process information
Example 6
Show Numeric Addresses (No DNS Resolution)
$ ss -n
State Recv-Q Send-Q Local Address:Port Peer Address:Port
ESTAB 0 0 192.168.1.5:22 192.168.1.100:54321
ESTAB 0 0 192.168.1.5:80 192.168.1.101:48392
Shows IP addresses and port numbers instead of resolving them to hostnames and service names using the '-n' option. This makes the command much faster since it skips DNS lookups. Recommended for scripts and quick checks.
Performance: Always use -n for faster output, especially with many connections
Example 7
Display Summary Statistics
$ ss -s
Total: 182 (kernel 197)
TCP: 12 (estab 3, closed 4, orphaned 0, synrecv 0, timewait 4/0)
UDP: 8
RAW: 1
FRAG: 0
Shows summary statistics of all socket types with the '-s' option. Provides a quick overview of network activity including established connections, listening sockets, and time-wait states. Great for monitoring overall network health.
Monitoring: Useful for getting a high-level view of system network activity
Example 8
Filter by Specific Port
$ ss -tn sport = :80
State Recv-Q Send-Q Local Address:Port Peer Address:Port
ESTAB 0 0 192.168.1.5:80 192.168.1.100:54321
ESTAB 0 0 192.168.1.5:80 192.168.1.101:48392
ESTAB 0 0 192.168.1.5:80 192.168.1.102:39821
Filters connections by source port using sport (source port) or dport (destination port). This example shows all TCP connections where the source port is 80 (HTTP). Excellent for monitoring specific services like web servers.
Syntax: Use 'sport = :PORT' for source, 'dport = :PORT' for destination
Example 9
Display Extended Socket Information
$ ss -e
State Recv-Q Send-Q Local Address:Port Peer Address:Port
ESTAB 0 0 192.168.1.5:22 192.168.1.100:54321
timer:(keepalive,19min,0) uid:1000 ino:12345
Shows extended socket information including timers, user IDs, and inode numbers using the '-e' option. Provides detailed internal socket state information useful for advanced troubleshooting and performance analysis.
Advanced Use: Helpful for debugging connection issues and understanding socket internals
Example 10
Comprehensive System Network Overview
$ ss -tulpn
Netid State Recv-Q Send-Q Local Address:Port Peer Address:Port
tcp LISTEN 0 128 0.0.0.0:22 0.0.0.0:* users:(("sshd",pid=1234,fd=3))
tcp LISTEN 0 128 0.0.0.0:80 0.0.0.0:* users:(("nginx",pid=5678,fd=6))
udp UNCONN 0 0 0.0.0.0:68 0.0.0.0:* users:(("dhclient",pid=910,fd=6))
A comprehensive command combining multiple options: -t (TCP), -u (UDP), -l (listening), -p (processes), -n (numeric). This is one of the most useful ss commands for system administrators, showing all listening services with process information.
Best Practice: Run this regularly to audit which services are exposed on your system
Bonus
Common ss Options Quick Reference
Basic Options:
-a Show all sockets (listening and non-listening)
-l Show only listening sockets
-t Show TCP sockets only
-u Show UDP sockets only
-n Show numeric addresses (no DNS resolution)
-p Show process using socket
-s Display summary statistics
Display Options:
-e Show extended socket information
-m Show socket memory usage
-o Show timer information
-i Show internal TCP information
Filters:
sport = :PORT Filter by source port
dport = :PORT Filter by destination port
src ADDRESS Filter by source address
dst ADDRESS Filter by destination address
state STATE Filter by connection state (ESTABLISHED, LISTEN, etc.)
Common Combinations:
ss -tulpn All listening TCP/UDP with processes (numeric)
ss -tan All TCP connections (numeric)
ss -s Summary statistics
ss -tn state established All established TCP connections
A comprehensive quick reference for the most commonly used ss command options and combinations. These commands are essential for network troubleshooting and system monitoring.