When troubleshooting a Linux server, identifying exactly what network traffic is flowing in and out of the machine is a critical diagnostic step. You might need to verify that your web server is actively listening on port 80, confirm that a database connection has been established, or investigate a suspicious IP address that is maintaining a persistent connection to your machine.
For decades, Linux administrators used the netstat command to view this information. However, netstat is officially deprecated and is painfully slow on busy servers. The modern, vastly superior replacement is the ss (Socket Statistics) command, which pulls data directly from the kernel space for lightning-fast network analysis.
Basic Usage of the ss Command
By default, if you simply type ss into your terminal and press Enter, it will output a massive list of all open, non-listening sockets (mostly established connections) on the system. On a busy server, this list will scroll endlessly.
To make the output useful, you must use specific flags to filter the data. The most common flags are:
-t: Show only TCP connections.-u: Show only UDP connections.-l: Show only “listening” ports (services waiting for an incoming connection).-n: Show numeric IP addresses and port numbers (preventsssfrom trying to resolve hostnames, which speeds up the command significantly).-p: Show the specific Process ID (PID) and program name using the socket (requiressudoprivileges).
How to Find Listening Services
The most frequent use case for ss is verifying that a service you just started (like Nginx, Apache, or SSH) is actually listening for traffic on the correct port.
To see all listening TCP ports, along with the numeric IP and port data, use the following combination of flags:
ss -tln
The output will show the “State” as LISTEN. Look at the “Local Address:Port” column. If you see 0.0.0.0:80, it means your web server is successfully listening for HTTP traffic on all network interfaces.
How to Identify the Program Using a Port
If you try to start a service and it crashes with an “Address already in use” error, it means another program is holding that port hostage. You can use ss to find the culprit.
You must add the -p flag to see the process information, which requires administrative privileges:
sudo ss -tlnp
Look at the far right column of the output. You will see the exact program name and its Process ID (e.g., users:(("nginx",pid=1042,fd=6))). Armed with this PID, you can use the kill command to terminate the rogue program and free up the port.
How to View Established Connections
If you want to see who is actively connected to your server right now, you should drop the -l (listening) flag and just view the active TCP connections.
ss -tn
The “State” column will show ESTAB (Established). The “Local Address:Port” shows your server’s IP and the service port (e.g., your IP ending in :22 for SSH). The “Peer Address:Port” column shows the remote IP address of the user or machine that is connected to you.
If you see dozens of ESTAB connections from a single, unrecognized “Peer Address” hammering your port 80 or 443, you may be experiencing a denial-of-service attack, and you can now take that IP address and block it in your firewall.