ss - another utility to investigate sockets

 The ss command (Socket Statistics) is a powerful command-line utility used in Linux to dump socket statistics and display detailed network connection information. It serves as the modern, high-performance replacement for the deprecated netstat command because it interacts directly with the Linux kernel via the netlink interface instead of slowly parsing /proc files. [1, 2, 3, 4]

Essential Syntax & Common Flags

When you run ss without any flags, it prints a long list of all open, non-listening network sockets that currently have established connections. To make the tool useful for debugging, you will typically combine it with the following core options: [1, 2]

-t: Restricts the output to TCP sockets.
-u: Restricts the output to UDP sockets.
-l: Shows only listening sockets (ports waiting for traffic).
-a: Shows all sockets, combining both listening and non-listening connections.
-n: Displays numerical IP addresses and ports instead of resolving them into hostnames or service names (e.g., 22 instead of ssh), which significantly speeds up execution.
-p: Lists the specific process names and PIDs utilizing each socket. [1, 2, 3]

---

Practical Examples for Common Tasks

1. See All Listening Services (The "Swiss Army Knife" Command)

To inspect every service actively listening on your machine along with its process name and raw port number, execute:

bash

sudo ss -tulpn

குறியீட்டைக் கவனமாகப் பயன்படுத்துங்கள்.

(Note: Running with sudo is required here so that ss has the privileges to fetch and display process names owned by other users or root). [1, 2]

2. Find What Process is Using a Specific Port

If you want to know what application is tying up a particular port (e.g., port 8080), you can use the built-in port filter string instead of grepping: [1, 2]

bash

sudo ss -tulpn sport = :8080

குறியீட்டைக் கவனமாகப் பயன்படுத்துங்கள்.

3. View Only Active, Established Connections [1]

To filter out idle listening sockets and view active network traffic, combine the protocol flags with a state filter: [1, 2]

bash

ss -at state established

குறியீட்டைக் கவனமாகப் பயன்படுத்துங்கள்.

4. Get a Quick Network Health Check [1]

If you are managing a heavily loaded server and want a high-level view of how many total connections are open without flooding your terminal, pull up the summary view: [1, 2]

bash

ss -s

குறியீட்டைக் கவனமாகப் பயன்படுத்துங்கள்.

---

Understanding the Output Columns

When you run a standard query, ss outputs data organized into columns: [1]

Netid: The protocol type (e.g., tcp, udp, or local file-based u_str Unix sockets).
State: The connection lifecycle state (e.g., ESTAB for active connections, LISTEN for services awaiting traffic).
Recv-Q / Send-Q: The queue size in bytes. For an active socket, non-zero or growing values mean data is getting backed up or delayed in transit.
Local Address:Port: The local IP address and port binding of your machine.
Peer Address:Port: The remote machine's IP address and port that yours is communicating with. [1, 2]

For further advanced options like connection timers or specific IPv4/IPv6 isolation, you can consult the official documentation on the man7.org ss manual page. [1]

What specific networking problem or port issue are you trying to troubleshoot on your Linux system right now?