The Linux ss Command: Inspecting Sockets and Connections

What ss Does

#

ss (socket statistics) displays information about network sockets. It shows what’s listening, what’s connected, and the state of every TCP/UDP socket on your system. It’s the modern replacement for netstat — faster and more capable.

Use it to answer:

• What ports are open on this machine?
• Is my service actually listening?
• Who’s connected to my server?
• Are there stuck or lingering connections?

Common Options

#

These combine naturally into a few standard invocations.

Standard Invocations

#

What’s listening on this machine?

#

# TCP listeners
ss -tlnp

# UDP listeners
ss -ulnp

# Both TCP and UDP
ss -tulnp

This is the most common use — “is my service running and on what port?”

Output:

State   Recv-Q  Send-Q  Local Address:Port  Peer Address:Port  Process
LISTEN  0       128     0.0.0.0:22          0.0.0.0:*          users:(("sshd",pid=1024,fd=3))
LISTEN  0       511     0.0.0.0:80          0.0.0.0:*          users:(("nginx",pid=2048,fd=6))
LISTEN  0       128     127.0.0.1:5432      0.0.0.0:*          users:(("postgres",pid=3072,fd=5))

What does the address mean?

#

Show all active connections

#

ss -tunap

This shows everything — listeners and established connections with process info.

Socket summary

#

ss -s

Output:

Total: 187
TCP:   45 (estab 12, closed 8, orphaned 0, timewait 5)
UDP:   6

Quick way to see the overall connection state of the system.

Filtering

#

By state

#

# Only established connections
ss -t state established

# Only time-wait sockets
ss -t state time-wait

# Only close-wait (often indicates a problem)
ss -t state close-wait

Available states:

By port

#

# Connections on port 443
ss -tn sport = :443

# Connections to remote port 443
ss -tn dport = :443

# Listening on port 8080
ss -tlnp sport = :8080

By address

#

# Connections to a specific IP
ss -tn dst 10.0.1.50

# Connections from a specific subnet
ss -tn src 192.168.1.0/24

Combining filters

#

# Established connections to port 443 from a specific subnet
ss -tn state established dport = :443 src 192.168.1.0/24

Reading TCP State

#

Recv-Q and Send-Q for established connections

#

A consistently growing Recv-Q means the application isn’t reading fast enough. A growing Send-Q means packets aren’t being acknowledged.

Recv-Q and Send-Q for LISTEN sockets

#

If Recv-Q approaches Send-Q on a listener, the server is getting overwhelmed with new connections.

TCP Internal Info

#

ss -ti

Shows per-connection details:

cubic wscale:7,7 rto:204 rtt:1.5/0.75 ato:40 mss:1448 cwnd:10 send 77.2Mbps

Useful for diagnosing slow connections — high RTT or low cwnd indicates a problem.

Practical Scenarios

#

Is my web server listening?

#

ss -tlnp | grep :80
# or
ss -tlnp | grep nginx

If nothing shows up, the service isn’t running or isn’t bound to the expected port.

Which process is using port 8080?

#

sudo ss -tlnp sport = :8080

The -p flag with sudo reveals the process name and PID.

How many connections does my server have?

#

# Count established connections to port 443
ss -t state established sport = :443 | wc -l

# Count by remote IP
ss -tn state established sport = :443 | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -rn | head -10

Are there connection issues?

#

# Check for close-wait (app not closing connections properly)
ss -t state close-wait | wc -l

# Check for time-wait accumulation
ss -t state time-wait | wc -l

# Check for SYN floods
ss -t state syn-recv | wc -l

Monitor connections in real time

#

watch -n 1 'ss -s'

Find connections to a specific remote server

#

ss -tn dst 10.0.1.50

Check if a port is externally accessible

#

# Locally, check it's listening on 0.0.0.0 (not just 127.0.0.1)
ss -tlnp sport = :5432

# If it shows 127.0.0.1:5432, it's only accessible locally
# If it shows 0.0.0.0:5432, it's accessible from the network

ss vs netstat

#

If you see netstat in documentation, translate to ss:

Best Practices

#

• Use ss -tlnp as your first check when a service seems unreachable — confirm it’s actually listening
• Always use -n to avoid slow DNS lookups on busy systems
• Use sudo with -p to see process names — without it, you only see sockets you own
• Watch for close-wait accumulation — it usually means your application has a connection leak
• Check the bind address — 127.0.0.1 means local only, 0.0.0.0 means network-accessible
• Use state filters instead of grep when looking for specific connection states — it’s faster and more precise
• Combine with watch for real-time monitoring during incident response