ss (Socket Statistics) — Viewing Network Connections in Linux¶

The ss (Socket Statistics) command is the modern Linux utility for displaying network sockets, active connections, listening ports, and protocol statistics. It is significantly faster and more powerful than the legacy netstat command and is the preferred tool for network diagnostics on modern Linux systems. Every Linux administrator, DevOps engineer, Cloud Architect, Network Engineer, and Site Reliability Engineer (SRE) should be proficient with ss.

Learning Path¶

Linux Mastery → Module 8: Networking → Lesson 7

Difficulty: Beginner → Intermediate

Reading Time: 65 Minutes

Course Progress

Course: Linux Mastery

Module: Networking

Lesson: 7 of 13

What You'll Learn¶

After completing this lesson, you'll be able to:

Understand network sockets
View active network connections
Display listening ports
Filter TCP and UDP connections
Identify services using ports
Monitor network activity
Troubleshoot production networking issues

Prerequisites¶

Complete:

Module 1 – Linux Fundamentals
Module 2 – Linux Command Line Essentials
Module 3 – Text Processing
Module 4 – File Management
Module 5 – Users and Groups
Module 6 – Process Management
Module 7 – Package Management
Module 8 Lessons 1–6

Why Learn ss?¶

Imagine:

A web server isn't accepting connections.
SSH suddenly stops working.
A database port appears closed.
An application is listening on the wrong port.

One of the first commands an administrator uses is:

ss

It quickly shows:

Active connections
Listening ports
Socket states
Associated processes

What is a Socket?¶

A socket is a communication endpoint identified by:

IP Address

+

Port Number

+

Protocol

Example:

192.168.1.10:22

Applications communicate through sockets.

What is ss?¶

ss stands for:

Socket Statistics

It displays:

TCP connections
UDP sockets
UNIX domain sockets
Listening services
Connection states
Network statistics

Basic ss Command¶

Display all sockets.

ss

Example:

Netid

State

Recv-Q

Send-Q

Display Listening Ports¶

ss -l

Shows services waiting for incoming connections.

Display TCP Connections¶

ss -t

Display UDP Connections¶

ss -u

Display Listening TCP Ports¶

ss -lt

Display Listening UDP Ports¶

ss -lu

Display All Listening Ports¶

ss -tuln

Options:

Option	Meaning
`-t`	TCP
`-u`	UDP
`-l`	Listening sockets
`-n`	Show numeric addresses (don't resolve hostnames or service names)

Example:

Show Processes Using Ports¶

sudo ss -tulpn

Example:

LISTEN

0

128

*:22

users:(("sshd",pid=900))

Displays:

Process name
Process ID (PID)
Listening port

Filter by Port¶

View connections on port 22.

ss -tuln | grep :22

View Established Connections¶

ss -t state established

Displays active TCP sessions.

View Connection Statistics¶

ss -s

Example:

TCP

Established

Closed

Timewait

Useful for obtaining a quick summary of socket usage.

Display UNIX Domain Sockets¶

ss -x

UNIX sockets are commonly used for communication between processes on the same machine.

Common Socket States¶

State	Description
LISTEN	Waiting for incoming connections
ESTAB	Connection established
TIME-WAIT	Waiting before closing completely
CLOSE-WAIT	Waiting for application to close
SYN-SENT	Connection request sent
SYN-RECV	Connection request received

Understanding these states helps diagnose connection issues.

Common Commands¶

Display all sockets.

ss

Display listening ports.

ss -l

Display listening TCP and UDP ports.

ss -tuln

Show processes.

sudo ss -tulpn

Connection summary.

ss -s

Real Production Examples¶

Check SSH.

sudo ss -tulpn | grep :22

Verify NGINX.

sudo ss -tulpn | grep :80

Verify HTTPS.

sudo ss -tulpn | grep :443

Check PostgreSQL.

sudo ss -tulpn | grep :5432

Verify MySQL.

sudo ss -tulpn | grep :3306

Production Perspective¶

ss is widely used for:

Linux servers
Cloud virtual machines
Kubernetes nodes
Containers
Database servers
Load balancers
API servers
Security investigations

It is one of the first commands used to verify whether a service is actually listening on the expected port.

Hands-on Lab¶

Task 1¶

Display all sockets.

ss

Task 2¶

Display listening ports.

ss -l

Task 3¶

Display all listening TCP and UDP ports.

ss -tuln

Task 4¶

Show listening services and associated processes.

sudo ss -tulpn

Task 5¶

Check whether SSH is listening.

sudo ss -tulpn | grep :22

Task 6¶

Display established TCP connections.

ss -t state established

Task 7¶

Display socket statistics.

ss -s

Task 8¶

Display UNIX domain sockets.

ss -x

Command Deep Dive¶

Command	Purpose	Production Example
`ss`	Display sockets	Network diagnostics
`ss -l`	Show listening sockets	Service verification
`ss -t`	Show TCP sockets	TCP analysis
`ss -u`	Show UDP sockets	UDP analysis
`ss -tuln`	Show listening TCP/UDP ports	Port verification
`ss -tulpn`	Show ports with processes	Service identification
`ss -s`	Display socket summary	Performance monitoring
`ss -x`	Show UNIX sockets	Local IPC troubleshooting

ss vs netstat¶

Feature	ss	netstat
Performance	Faster	Slower
Default on Modern Linux	✅	❌
Displays Socket Statistics	✅	Limited
Shows Listening Ports	✅	✅
Shows Active Connections	✅	✅
Shows Processes	✅	✅ (with options)

ss is the recommended replacement for netstat on modern Linux systems.

Production Troubleshooting Scenario¶

Scenario

Users report they cannot access a web application.

Investigation:

Check whether NGINX is listening.

sudo ss -tulpn | grep :80

No output.

Check the service.

systemctl status nginx

NGINX is stopped.

Start the service.

sudo systemctl start nginx

Verify again.

sudo ss -tulpn | grep :80

Output:

LISTEN

*:80

The application is now reachable.

Best Practices¶

Use ss instead of the deprecated netstat.
Verify that services are listening before troubleshooting firewalls.
Use -n for faster output by avoiding DNS resolution.
Use -p to identify the process associated with a socket.
Monitor connection states during performance troubleshooting.

Common Mistakes¶

❌ Forgetting to use sudo when viewing process information.

✅ Remember to to use sudo when viewing process information.

❌ Assuming a running service is listening on the expected port.

✅ Verify a running service is listening on the expected port instead of assuming it.

❌ Ignoring connection states such as TIME-WAIT and CLOSE-WAIT.

✅ Always review connection states such as TIME-WAIT and CLOSE-WAIT.

❌ Using netstat on systems where ss is available.

✅ Avoid using netstat on systems where ss is available when a safer approach exists.

Interview Questions¶

Beginner¶

What does ss stand for?
Which command displays listening TCP and UDP ports?
What is a socket?
What does the -l option do?

Intermediate¶

What is the purpose of the -p option?
What is the difference between TCP and UDP sockets?
How do you display established TCP connections?
What does the LISTEN state indicate?

Architect Level¶

How would you troubleshoot a production service that is not accepting connections?
Why is ss preferred over netstat?
How would you identify which process is using a specific network port?

Summary¶

In this lesson, you learned:

Network sockets
The ss command
Listening ports
TCP and UDP sockets
Connection states
Process identification
Socket statistics
Production troubleshooting

The ss command is the modern standard for inspecting network sockets on Linux. It provides fast, detailed information about active connections, listening services, and socket states, making it an essential tool for diagnosing networking and application issues.

Key Takeaways¶

ss is the preferred replacement for netstat.
Use ss -tuln to view listening TCP and UDP ports.
Use ss -tulpn to identify which process owns a listening port.
Socket states provide valuable troubleshooting information.
Always verify that a service is listening before investigating network connectivity issues.
ss is an essential tool for production Linux administration.

What's Next?¶

netstat — Viewing Network Statistics and Connections in Linux

You'll explore:

Legacy network statistics
Viewing network connections
Routing tables
Interface statistics
Differences between netstat and ss
When netstat is still useful
Production troubleshooting techniques

Although ss is the preferred tool today, understanding netstat remains valuable because it is still encountered in legacy Linux systems and documentation.