How to Use the ss Command to Inspect Socket Statistics and Network Connections in Linux

Troubleshooting network latency, auditing listening ports, and identifying unauthorised connections are fundamental tasks for Linux system administrators. For decades, the legacy netstat tool was the universal standard for socket inspections. However, netstat relies on parsing slow /proc/net text pseudo-files, making it inefficient and unresponsive on high-traffic servers managing tens of thousands of active socket connections. The modern replacement is ss (Socket Statistics), part of the official iproute2 package. By communicating directly with Linux kernel netlink subsystems, ss dumps detailed socket metrics in a fraction of the time with far greater filtering flexibility.

Why the ss Command Replaced netstat

While netstat is officially deprecated across modern Linux distributions (such as Ubuntu, Debian, RHEL, and Fedora), ss delivers three distinct technical improvements:

• Direct Netlink Kernel Interface: Bypasses slow /proc filesystem parsing to fetch socket states directly from kernel tables, completing sweeps in milliseconds.
• TCP Diagnostic Internals: Exposes advanced TCP internals such as round-trip time (RTT), congestion control algorithms (BBR, Cubic), socket buffer sizes, and retransmission counters.
• Granular State Filtering: Native support for filtering sockets by connection state (e.g., established, listen, time-wait) without requiring piping through grep.

Inspecting Listening Ports and Active Daemons

When deploying web servers (Nginx, Apache) or databases (PostgreSQL, MySQL), you need to verify which network ports are actively listening for incoming traffic.

To display all listening TCP sockets along with their process names and PIDs:

sudo ss -tulpn

Breaking down the flags used in this standard diagnostic command:

• -t: Display TCP sockets.
• -u: Display UDP sockets.
• -l: Display only listening sockets (excluding established outbound sessions).
• -p: Show the process name and Process ID (PID) holding the socket open (requires sudo).
• -n: Show numeric port numbers (e.g., 80, 443, 5432) instead of resolving service names (e.g., http, https, postgresql).

Filtering Connections by Protocol and State

To audit currently active client connections without being overwhelmed by thousands of listening services, filter by TCP connection states:

To display all currently established (active) TCP connections:

ss -t -a state established

To inspect sockets lingering in the TIME-WAIT or CLOSE-WAIT state to troubleshoot connection pooling exhaustion:

ss -t state time-wait

Filtering by Port Number and IP Address

Unlike netstat which required external pipe utilities to find specific ports, ss includes native conditional filtering syntax:

To find all connections originating from or bound to port 80 or 443:

ss -t '( sport = :http or sport = :https )'

To find all outbound connections targeting a specific remote IP address:

ss -t dst 192.168.1.100

To display all connections targeting a specific remote port range (e.g., ports above 1024):

ss -t 'dport > :1024'

Essential ss Command Options Reference

Flag / Syntax	Description	Example Use
-t	Filter for TCP sockets	ss -t
-u	Filter for UDP sockets	ss -u
-l	List listening sockets only	ss -tl
-a	List all sockets (both listening and established)	ss -ta
-n	Do not resolve service names (numeric output)	ss -tln
-p	Show process and PID owning the socket	sudo ss -tp
-s	Display summary statistics of all sockets	ss -s
-e	Display extended socket information (uid, ino)	ss -te

Displaying Overall Network Socket Summaries

To obtain an instant high-level overview of total TCP, UDP, and raw sockets active across the system, use the summary flag:

ss -s

The system outputs a clean summary matrix showing total sockets in use, how many TCP sockets are currently established, closed, or orphaned, providing an instant health check during traffic spikes.

Frequently Asked Questions

Why do I need sudo to see process names in ss?

Because socket descriptors belong to specific system user accounts and daemon privileges, a standard unprivileged user cannot inspect process IDs belonging to system daemons like Nginx or PostgreSQL. Running with sudo grants root netlink access.

How do I inspect UNIX domain sockets with ss?

Pass the -x flag: ss -xlp. This lists all local inter-process communication (IPC) UNIX sockets (such as Docker, systemd, and local database sockets).

Can ss resolve hostnames instead of numeric IPs?

Yes. If you omit the -n flag, ss -r will attempt DNS reverse resolution to display hostnames. However, on busy networks, DNS lookups can slow down output.