ss (Socket Statistics)

Every network problem starts with the same question: who is talking to whom?

Your web server isn't responding. Your database connection keeps dropping. Something is hogging port 3000. Before you can fix anything, you need to see the connections.

The ss command answers this instantly. It shows you every socket on your Linux system—what's listening, what's connected, what's waiting to close. It's the modern replacement for netstat, and it's dramatically faster because it reads directly from the kernel instead of parsing text files.

Seeing What's Happening

The most common thing you'll want to know: what's listening on which ports?

ss -tlnp

This breaks down as:

• -t: TCP sockets
• -l: Only listening (waiting for connections)
• -n: Show port numbers, not service names
• -p: Show which program owns each socket

State    Recv-Q   Send-Q     Local Address:Port      Peer Address:Port   Process
LISTEN   0        128              0.0.0.0:22             0.0.0.0:*       users:(("sshd",pid=1234,fd=3))
LISTEN   0        128          127.0.0.1:3306           0.0.0.0:*       users:(("mysqld",pid=5678,fd=10))
LISTEN   0        128              0.0.0.0:80             0.0.0.0:*       users:(("nginx",pid=9012,fd=6))

Now you know: SSH is listening on port 22, MySQL on 3306 (but only localhost), and nginx on 80.

The Universal Frustration

"Port already in use."

Every developer has seen this error. Something is squatting on the port you need. Find it:

ss -tlnp | grep :3000

Or with ss's built-in filtering (no grep needed):

ss -tlnp sport = :3000

Now you know what to kill.

Active Connections

Listening sockets wait for connections. But what about connections that are actually happening?

ss -tn

This shows established TCP connections:

State      Recv-Q  Send-Q    Local Address:Port    Peer Address:Port
ESTAB      0       0         192.168.1.100:54321   93.184.216.34:443
ESTAB      0       0         192.168.1.100:54322   151.101.1.69:443

Your machine is talking to two remote servers on port 443 (HTTPS).

Add -p to see which programs:

ss -tnp

Built-In Filtering

This is where ss outshines netstat. Instead of piping through grep, you can filter directly:

By state:

ss state established
ss state listening
ss state time-wait

By port:

ss sport = :80          # Source port 80
ss dport = :443         # Destination port 443
ss sport ge :1024       # Source port >= 1024

By address:

ss dst 93.184.216.34           # Connections TO this IP
ss src 192.168.1.0/24          # Connections FROM this subnet

Combined:

ss state established '( dport = :443 or sport = :443 )'

When Connections Go Wrong

Slow application? Check the connection quality:

ss -ti

This shows TCP internals—round-trip time, retransmissions, congestion window. If you see high retransmission counts, your network is dropping packets.

Receive queue backing up?

ss -tn | awk '$2 > 0 {print}'

A growing receive queue means your application isn't reading data fast enough.

Quick Overview

Want to know how many connections you have without listing them all?

ss -s

Total: 156
TCP:   42 (estab 15, closed 8, orphaned 0, timewait 7)

Transport Total     IP        IPv6
TCP       34        28        6
UDP       8         6         2

The Options You'll Actually Use

Combine them: ss -tulnp shows all listening TCP and UDP sockets with process info.

Understanding Socket States

When you see connection states, here's what matters:

LISTEN: Waiting for incoming connections. This is your server.

ESTAB: Active connection. Data is flowing (or could flow).

TIME-WAIT: Connection closed, but socket lingers briefly to catch any stray packets. Lots of these is normal for busy servers.

CLOSE-WAIT: The remote side closed, but your application hasn't. If these accumulate, your application has a bug—it's not closing connections properly.

Real Scenarios

Service won't start:

sudo ss -tlnp | grep :8080

Find what's blocking the port.

Too many connections:

ss -s

Check if you're hitting limits.

Application can't reach server:

ss -tn dst 10.0.0.50

See if connections exist or are stuck.

Monitor connection count:

watch -n 1 'ss -tan state established | wc -l'

For UDP

UDP doesn't have connection states like TCP, but you can still see listening services:

ss -ulnp

DNS servers (port 53), DHCP (67/68), and NTP (123) typically show up here.

Coming from netstat

Most netstat commands translate directly:

• netstat -tulpn → ss -tulpn
• netstat -an → ss -an

For routing tables, use ip route instead—ss is purely for sockets.