ss
Networking
Usage
ss -tulpnThe modern way to list open sockets on Linux, the successor to netstat and much faster on a busy host; note that `-p` only reveals the owning process when you are root.
Common flags
| Flag | Meaning |
|---|---|
| -t / -u | TCP / UDP sockets. |
| -l | Listening sockets only. |
| -n | Numeric ports, no /etc/services lookup. |
| -p | Show the owning process. Needs root to see processes that are not yours. |
| -a | Every socket, listening or not. |
| state established | Filter by state, written after the flags. |
| -s | A summary count of sockets per protocol. |
Examples
ss -tulpnEvery listening TCP and UDP port with the process behind it.
ss -tn state establishedOnly the connections that are actually carrying traffic.
ss -tn "( dport = :443 )"Outgoing HTTPS connections only.
When a connection fails, these narrow down how far it got — name not resolving, no route, or a blocked port.
How to read this
- Square brackets [ ] mark a part you may leave out.
- An ellipsis … means you can list more than one.
- Flags are case-sensitive — in some commands -r and -R do different things.
Questions
Q. What does ss do?
The modern way to list open sockets on Linux, the successor to netstat and much faster on a busy host; note that `-p` only reveals the owning process when you are root.
Q. How do I type it?
ss -tulpn — square brackets mark the parts you can leave out.
Q. How many flags are worth knowing?
7 are listed here; the full set is in man ss. This command sits under Networking.
Related commands
man page: man ss