How to Check Open Sockets, Network Statistics, and Listening Ports in Linux Using ss

Modern Socket Inspection with ss in Linux

For decades, system administrators and network engineers relied on the classic netstat utility to inspect active network connections, routing tables, and interface statistics. However, netstat has been formally deprecated across modern Linux distributions in favour of ss (Socket Statistics), part of the core iproute2 package. Unlike legacy tools that parse raw records from the slower /proc/net virtual filesystem, ss communicates directly with Linux kernel Netlink sockets. This direct interface enables significantly faster query execution, lower memory overhead, and richer diagnostic insights into TCP, UDP, raw, and Unix domain sockets.

Understanding Core ss Command Syntax and Options

The ss command provides a compact suite of command-line flags that can be chained together to filter connections precisely. The most essential flags include:

• -t: Filter for TCP sockets only.
• -u: Filter for UDP sockets only.
• -l: Display only listening sockets (ports actively waiting for incoming client connections).
• -a: Display all sockets (both listening and established connections).
• -n: Show numerical port and IP addresses instead of attempting DNS hostname or service name resolution.
• -p: Show the associated process name and Process ID (PID) owning each socket (requires root or sudo privileges).
• -e: Output detailed socket memory and user information.
• -s: Display comprehensive summary statistics across all socket families.

Listing All Listening TCP Ports and Services

When securing a Linux server, identifying which daemons are listening on external network interfaces is a critical security task. To list all active listening TCP ports with numerical addresses and process owners, execute:

sudo ss -tlnp

The resulting terminal table includes key columns:

• State: Confirms the socket status (such as LISTEN).
• Recv-Q / Send-Q: Displays the quantity of queued packets waiting in socket buffers. For listening sockets, Recv-Q represents the current backlog of unaccepted connections.
• Local Address:Port: Shows the bound IP and port (e.g. 0.0.0.0:22 indicates SSH listening on all IPv4 interfaces, while 127.0.0.1:3306 indicates MySQL restricted safely to localhost).
• Peer Address:Port: Indicates remote connection targets (displayed as 0.0.0.0:* for listening services).
• Process: Shows the daemon name, PID, and file descriptor number (e.g. users:(("sshd",pid=842,fd=3))).

Auditing Active UDP Sockets

Because UDP is a connectionless transport protocol, sockets do not enter a formal “LISTEN” handshake state like TCP. To inspect all UDP sockets on your system, combine the UDP and all flags:

sudo ss -uanp

This command captures DNS responders (port 53), NTP daemons (port 123), DHCP clients, and media streaming endpoints.

Filtering Connections by Port or State

Rather than piping large outputs into grep, ss features powerful native state-matching and conditional filtering syntax.

Filtering by Connection State

To inspect only established, active TCP data streams currently transmitting payloads:

ss -t state established

You can also query closing states to identify lingering connections causing port exhaustion:

ss -t state time-wait

Filtering by Specific Port Number

To isolate traffic associated with a specific port (such as HTTP port 80 or HTTPS port 443), use conditional evaluation syntax:

ss -tln 'sport = :80 or sport = :443'

Similarly, to check for established outbound connections destined for a remote database server on port 5432:

ss -tan 'dport = :5432'

Displaying High-Level Socket Summary Statistics

If you need an instantaneous snapshot of total network utilisation without scrolling through hundreds of individual connections, run:

ss -s

This command returns a concise breakdown of total allocated sockets, TCP connection states (closed, orphaned, timewait), UDP channels, and raw sockets. It provides system administrators with an immediate pulse check during high traffic surges or potential denial-of-service events.

Practical Diagnostic Best Practises

Whenever you troubleshoot connectivity bottlenecks or firewall configurations on Linux:

• Always append -n when diagnosing active network faults; DNS reverse lookups can cause commands to hang if your resolver is unreachable.
• Always precede -p with sudo; without elevated root privileges, process names and PIDs are omitted from the output.
• Use ss -s as your first diagnostic step to verify whether high memory consumption is being driven by socket buffer leakage.