LFCE 99 🐧 ss — Socket Statistics - KandZ

⏱️ Estimated read: 11 min | |

ss is the socket statistics utility that replaces the deprecated netstat. It reads the socket information directly from the kernel through the Netlink interface, which makes it significantly faster than netstat‘s parsing of /proc/net/tcp, especially on the servers with the high connection counts . The previous chapters covered the packet-level analysis with tcpdump, tshark, and Wireshark; this chapter covers the socket-level view: which ports are listening, which connections are established, and which process owns each socket.

Quick How-To Guides & Fast FixesNeed a quick fix or step-by-step solution? Browse our fast answers on HowTo.KandZ.me:

Operating Systems CLI →Dev Environment Languages →Web Network Tools →Security Accounts →Security Access Tech →Device Phone Basics →Social Messaging →Digital Files Media →

The command is part of the iproute2 package, and it is pre-installed on most modern distributions . The default invocation without the options shows the open non-listening TCP sockets that have established connections, which is the quick view of the active traffic . The flags are largely a superset of netstat‘s, and the mnemonic letters t, u, l, n, and p are shared between the two tools . The filter expression after the options narrows the output by the state, the address, the port, and the other criteria.

Key point: The -t flag selects TCP, the -u selects UDP, the -l selects the listening sockets, the -n disables the name resolution, and the -p shows the owning process . The ss -tlnp combination is the single most useful command for auditing a server’s exposed surface: it lists every TCP port that is open to the network and the program behind each one . The -p flag requires the root privileges to show the processes that the user does not own .

Why ss requires the state and expression filters

The default-view problem.

The ss without the options shows only the established TCP connections. The listening sockets, the UDP sockets, and the Unix domain sockets are hidden unless the -a or the -l flag is added . The -a shows both the listening and the non-listening sockets, and the -l shows only the listening ones. The choice depends on the question: “what is listening” uses -l, and “what is connected” uses the default or -a.

The state-filter problem.

The TCP connections have the states: established, syn-sent, syn-recv, fin-wait-1, fin-wait-2, time-wait, closed, close-wait, last-ack, listening, and closing . The state keyword filters by the specific state, and the ss -t state established shows the active connections only . The state filter is the mechanism that isolates the connections in the specific phase, such as the time-wait sockets that accumulate after the high connection churn.

The expression problem.

The expression after the state filter matches the address, the port, the device, and the other criteria. The dst 192.168.1.100 matches the destination address, and the dport :80 matches the destination port . The sport and the src match the source side, and the port matches either side. The expressions can be combined with the and, the or, and the not operators, and the parentheses group the subexpressions . The expression is the mechanism that narrows the output to the specific connection, such as the ss -tn dport :443 for the HTTPS traffic.

a. The listening sockets and the process owners

The -l flag selects the listening sockets, and the -p shows the owning process.

# List the listening TCP sockets with the process
ss -tlnp

# List the listening TCP and UDP sockets
ss -tulnp

# Find the process on the port 22
ss -tlnp | grep :22

The ss -tlnp shows the TCP listeners, the numeric ports, and the process names and PIDs . The -tulnp adds the UDP listeners, which is the complete inventory of the exposed surface. The grep :22 filters the output to the port 22, which is the quick way to find the process that owns the SSH port . The process column requires the root, or it shows the blank for the sockets that the user does not own .

The -s flag prints the summary statistics.

# Summary of the socket usage
ss -s

The ss -s shows the total socket count and the breakdown by the protocol, which is the quick overview of the system’s network activity . The summary is faster than the full listing when the socket count is huge, because it does not parse the individual socket entries .

b. The connection state and the address filters

The state keyword filters by the TCP state, and the address and the port expressions filter by the endpoints.

# Show the established connections
ss -t state established

# Show the connections to a specific host
ss -tn dst 192.168.1.100

# Show the connections on the port 443
ss -tn dport :443

# Show the SSH connections
ss -tn '( sport = :ssh or dport = :ssh )'

The ss -t state established shows the active TCP connections, which is the view of the current sessions . The dst 192.168.1.100 filters by the destination address, and the dport :443 filters by the destination port . The '( sport = :ssh or dport = :ssh )' expression shows the SSH connections in both the directions . The expressions are the mechanism that answers “who is connected to what” for the specific service.

The -i flag shows the internal TCP information.

# Show the internal TCP information
ss -tin dst 192.168.1.11 dport 2049

The ss -tin shows the congestion window, the RTT, the retransmission timeout, and the pacing rate, which are the TCP-level details that the connection listing alone does not show . The rtt is the average round-trip time, the cwnd is the congestion window, and the retrans counters show the retransmissions . The internal information is the mechanism for the TCP performance analysis at the socket level.

c. The Unix sockets and the network namespaces

The -x flag shows the Unix domain sockets, and the -N flag switches to the specific network namespace.

# Show the Unix domain sockets
ss -x

# Show the Unix sockets connected to the X server
ss -x src /tmp/.X11-unix/*

# Show the sockets in a specific network namespace
ss -N myns -tlnp

The ss -x shows the Unix domain sockets, which are the local inter-process communication channels rather than the network connections . The ss -x src /tmp/.X11-unix/* finds the processes connected to the X server, which is the example from the man page . The -N myns switches to the myns network namespace, which is the mechanism for the container and the namespace troubleshooting .

Complete Example Session

# ============================================
# PART 1: THE LISTENING PORTS
# ============================================
ss -tlnp
# Output: the listening TCP sockets with the processes

# ============================================
# PART 2: THE UDP LISTENERS
# ============================================
ss -ulnp
# Output: the listening UDP sockets

# ============================================
# PART 3: THE SUMMARY
# ============================================
ss -s
# Output: the socket count by the protocol

# ============================================
# PART 4: THE ESTABLISHED CONNECTIONS
# ============================================
ss -t state established
# Output: the active TCP connections

# ============================================
# PART 5: THE CONNECTIONS TO A HOST
# ============================================
ss -tn dst 192.168.1.100
# Output: the connections to the specific host

# ============================================
# PART 6: THE CONNECTIONS ON A PORT
# ============================================
ss -tn dport :443
# Output: the HTTPS connections

# ============================================
# PART 7: THE SSH CONNECTIONS
# ============================================
ss -tn '( sport = :ssh or dport = :ssh )'
# Output: the SSH connections

# ============================================
# PART 8: THE TCP INTERNAL INFORMATION
# ============================================
ss -tin dport :443
# Output: the RTT, the cwnd, and the retransmissions

# ============================================
# PART 9: THE UNIX SOCKETS
# ============================================
ss -x
# Output: the Unix domain sockets

# ============================================
# PART 10: THE NETWORK NAMESPACE
# ============================================
ss -N myns -tlnp
# Output: the listening sockets in the namespace

The ten parts demonstrate the ss surface: the listening ports, the UDP listeners, the summary, the established connections, the host filter, the port filter, the SSH filter, the TCP internals, the Unix sockets, and the network namespace. The critical audit is Part 1: the ss -tlnp lists every open TCP port and the process behind it, which is the first step of the server hardening.

Quick Reference

Common Options

Option	Purpose
`-t`	TCP sockets
`-u`	UDP sockets
`-l`	Listening sockets
`-n`	Numeric output (no name resolution)
`-p`	Show the owning process
`-a`	All sockets (listening + established)
`-s`	Summary statistics
`-x`	Unix domain sockets
`-i`	Internal TCP information
`-N <ns>`	Switch to the network namespace

TCP States

State	Meaning
`established`	Active connection
`listening`	Waiting for the connections
`time-wait`	Closed, waiting for the late packets
`close-wait`	Remote closed, local closing
`syn-sent`	Connection request sent
`fin-wait-1` / `fin-wait-2`	Connection closing

Filter Expressions

Expression	Matches
`dst <host>`	Destination address
`src <host>`	Source address
`dport :<port>`	Destination port
`sport :<port>`	Source port
`port :<port>`	Either port
`( ... or ... )`	Grouped conditions

The Audit Command

Command	Purpose
`ss -tlnp`	The listening TCP ports with the processes
`ss -tulnp`	The listening TCP and UDP ports
`ss -s`	The summary statistics

Best Practices

✅ Do This:

# Audit the listening ports
ss -tlnp                                                       # ✅

# Use the numeric output for the speed
ss -tln                                                        # ✅

# Filter by the destination port
ss -tn dport :443                                              # ✅

# Show the internal TCP information for the performance
ss -tin dport :443                                             # ✅

# Use the state filter for the established connections
ss -t state established                                        # ✅

# Run as root for the process owners
sudo ss -tlnp                                                  # ✅

❌ Don’t Do This:

# Use netstat on the modern system
netstat -tlnp    # Deprecated and slower                        # ❌

# Forget the -n and wait for the DNS
ss -tlnp    # Slow if the DNS is unreachable                   # ❌

# Expect the process owners without the root
ss -tlnp    # The PID column is blank for others' sockets      # ❌

# Use the default view for the listening ports
ss    # Only the established connections                       # ❌

# Assume the listening socket is reachable
ss -tlnp    # Check the Local Address column for 0.0.0.0 vs 127.0.0.1 # ❌

Common Pitfalls

Pitfall	Why It Happens	Fix
The process column is empty	Not running as root	`sudo ss -tlnp`
The output is slow	Name resolution enabled	Add `-n`
The listening ports are missing	Used the default view	Add `-l`
The filter syntax error	The spaces around the `=`	Use the `dport :80` form
The port is not reachable	The socket bound to `127.0.0.1`	Check the Local Address

Real-World Examples

1. Listening TCP ports

ss -tlnp

2. Listening TCP and UDP ports

ss -tulnp

3. Summary statistics

ss -s

4. Established connections

ss -t state established

5. Connections to a host

ss -tn dst 192.168.1.100

6. Connections on port 443

ss -tn dport :443

7. SSH connections

ss -tn '( sport = :ssh or dport = :ssh )'

8. TCP internal information

ss -tin dport :443

9. Unix sockets

ss -x

10. Network namespace

ss -N myns -tlnp

Visual

The Socket State View

┌──────────────────────────────────────────────────────────────┐
│  ss SHOWS THE SOCKETS IN EACH STATE                          │
│                                                              │
│  LISTEN ──▶ ESTABLISHED ──▶ FIN-WAIT ──▶ TIME-WAIT           │
│                                                              │
│  ss -l          ss -t state established    ss -t state all   │
│                                                              │
│  The default view shows only the established TCP sockets.    │
│  The -l shows the listeners; the -a shows both.              │
└──────────────────────────────────────────────────────────────┘

The Audit Command

┌──────────────────────────────────────────────────────────────┐
│  ss -tlnp IS THE SERVER AUDIT COMMAND                        │
│                                                              │
│  ┌────────────────────────────────────────────────────────┐  │
│  │ State   Local Address:Port   Process                   │  │
│  │ LISTEN  0.0.0.0:22           sshd                      │  │
│  │ LISTEN  0.0.0.0:80           nginx                     │  │
│  │ LISTEN  127.0.0.1:5432       postgres                  │  │
│  └────────────────────────────────────────────────────────┘  │
│                                                              │
│  The Local Address column shows the binding:                 │
│  0.0.0.0 means all the interfaces; 127.0.0.1 means local only│
└──────────────────────────────────────────────────────────────┘

The Filter Expression

┌──────────────────────────────────────────────────────────────┐
│  THE EXPRESSION NARROWS THE OUTPUT                           │
│                                                              │
│  ss -tn dport :443                                           │
│       │    │                                                 │
│       │    └── destination port 443                          │
│       └── TCP, numeric                                       │
│                                                              │
│  ss -tn '( sport = :ssh or dport = :ssh )'                   │
│       │                                                      │
│       └── the SSH connections in both directions             │
└──────────────────────────────────────────────────────────────┘

Summary

Item	Value
Tool	`ss` (socket statistics)
Package	`iproute2`
Default view	Established TCP connections
Listening TCP	`ss -tlnp`
Listening TCP + UDP	`ss -tulnp`
Summary	`ss -s`
State filter	`state established`
Address filter	`dst <host>`, `src <host>`
Port filter	`dport :<port>`, `sport :<port>`
TCP internals	`ss -tin`
Unix sockets	`ss -x`
Network namespace	`ss -N <ns>`

Key takeaways:

ss replaces netstat and is faster. It reads the socket information directly from the kernel through the Netlink interface, which avoids the /proc/net/tcp parsing that netstat performs. The speed difference is significant on the servers with the high connection counts .
The -tlnp combination is the server audit command. It lists every listening TCP port with the numeric port and the owning process. The Local Address column shows the binding: 0.0.0.0 means all the interfaces, and 127.0.0.1 means the local only .
The default view shows only the established TCP connections. The -l adds the listening sockets, the -u adds the UDP, and the -a shows both the listening and the established. The choice depends on the question .
The state filter isolates the specific TCP state. The established, the time-wait, and the close-wait are the states that the filter matches. The ss -t state established shows the active connections, and the time-wait view shows the sockets that accumulate after the high churn .
The expression filters by the address and the port. The dst, the src, the dport, and the sport are the predicates, and the and, the or, and the not combine them. The '( sport = :ssh or dport = :ssh )' is the mechanism for the bidirectional service filter .
The -p flag requires the root for the full output. The process column shows the PID and the program name only for the sockets that the user owns, or for all the sockets when the command runs as root .

Remember: ss is the socket statistics tool that replaces netstat. The -tlnp combination is the audit command, the -s is the summary, and the state filter and the expression narrow the output. The -p requires the root, and the -n disables the name resolution. The Local Address column shows the binding, and the 0.0.0.0 vs 127.0.0.1 distinction determines the reachability. The result is the tool that answers “what is listening on this server” and “who is connected to it” faster than the deprecated netstat.

Was this helpful?

Stop using slow, ad-bloated tool sites! 🤮

🔎 Search “KandZ Tools” on Google to use many professional utilities for free.

KandZ.me is the ultimate minimalist hub for:
✅ Finance (Mortgage, Interest, Inflation)
✅ Tech (Base64, JSON, Dev Suite, IP)
✅ Health (BMI, BMR, TDEE)
✅ Productivity (Timer, Workspace, QR)

⚡️ Fast & Private
🔒 No data leaves your device
💎 100% Free

🔗 Use it now: https://tools.kandz.me
🔖 Bookmark it—you’ll need it later!