How to Use the ss Command in Linux to Inspect Sockets, Network Connections, and Listening Ports

For decades, system administrators and network engineers relied on the netstat utility to inspect active network sockets, routing tables, and interface statistics. However, on modern Linux distributions, netstat is officially deprecated because it reads directly from /proc/net, which can cause severe performance bottlenecks on systems handling tens of thousands of concurrent connections. The ss (Socket Statistics) command, part of the standard iproute2 package, has completely replaced netstat by communicating directly with the Linux kernel via netlink sockets to deliver lightning-fast network diagnostics.

Core Syntax and Fundamental Options of ss

The basic execution of ss without arguments lists all non-listening open sockets (such as active UNIX domain sockets and established TCP connections). To extract targeted network telemetry, specific flag combinations are utilized:

ss [options] [filter]

The most widely adopted operational flags include:

• -t: Display only TCP sockets.
• -u: Display only UDP sockets.
• -l: Display listening sockets only (services waiting for inbound connections).
• -a: Display all sockets (both listening and established).
• -n: Show numeric ports and IP addresses rather than attempting DNS or service name resolution.
• -p: Show the process name and Process ID (PID) utilizing the socket (requires root or sudo privileges).

Essential ss Commands for Linux Network Administration

1. Listing All Active Listening Ports

To identify every daemon and service currently waiting for incoming TCP and UDP connections with exact process names, run:

sudo ss -tulpn

This command outputs the socket state (LISTEN), receive/send queues, local address and port, peer address, and the specific program holding the port (such as nginx, sshd, or systemd-resolved).

2. Viewing Socket Summary Statistics

When diagnosing memory pressure or suspected SYN-flood attacks, viewing overall socket allocation statistics provides instant clarity without printing long lists:

ss -s

The output presents a concise summary of total sockets in use, broken down by TCP, UDP, RAW, and IPv4/IPv6 socket states.

3. Filtering by Port Number or Service Name

Instead of piping thousands of lines into grep, ss includes native filtering capabilities that execute directly inside kernel space. To find all connections interacting with port 443 (HTTPS) or port 22 (SSH):

ss -tan '( sport = :443 or dport = :443 )'
ss -tan sport = :22

4. Filtering by TCP Connection State

You can isolate connections based on standard TCP lifecycle states, such as established, time-wait, close-wait, or syn-sent:

ss -t state established
ss -t state time-wait

Comparison: netstat vs. ss Command Equivalents

Administrative Goal	Legacy netstat Command	Modern ss Command
List all listening TCP/UDP ports	netstat -tulpn	ss -tulpn
Show all established TCP connections	netstat -atn	ss -tatn
Filter by specific destination IP	netstat -an | grep 192.168.1.1	ss -tan dst 192.168.1.1
Display socket summary counter	netstat -s	ss -s

Inspecting Detailed TCP Internal Diagnostics

For high-level performance engineering and troubleshooting network latency, passing the -i (internal) flag reveals deep kernel metrics for individual TCP sockets, including round-trip time (RTT), congestion window (cwnd), bandwidth estimates, and retransmissions:

ss -ti

Analyzing these parameters allows system administrators to determine whether slow web responses stem from server-side socket buffer constraints or network-level packet loss on client links.