ss Command in Linux: Display Socket Statistics and Connections

The ss command in Linux lists open sockets and active network connections. It replaced the deprecated netstat command and is available by default on all current Linux distributions. ss reads directly from kernel socket data structures, making it noticeably faster than netstat on systems with large numbers of connections.

How to Use the ss Command in Linux

The syntax is:

bashss [OPTIONS] [FILTER]

Without options, ss shows only non-listening sockets with an established connection. Add -a to list all sockets regardless of state:

bashss -a

The output columns are: Netid (socket type), State (connection state), Recv-Q and Send-Q (queue depths), local address and port, and peer address and port.

Filter by socket type:

bashss -ta    # TCP sockets including listeningss -ua    # UDP socketsss -xa    # Unix domain sockets (used for IPC between local processes, not network)

The -x flag is for Unix domain sockets — a different protocol family entirely, not related to TCP or UDP network traffic.

ss -tulpn is the most commonly used combination for listing listening services:

bashss -tulpn

What each flag does:

• -t — TCP
• -u — UDP
• -l — listening sockets only
• -p — process name and PID
• -n — numeric output (disables hostname and service name resolution)

-n is worth highlighting. Without it, ss resolves port numbers to names like ssh or http, which is slower and produces output that can vary between systems. With -n, port numbers are always raw integers — reliable for scripting and grepping.

Filter Sockets by Port, State, and Address

To find which process is using port 80:

bashsudo ss -tulpn | grep :80

For more targeted filtering, use the built-in filter expressions. These are evaluated by the kernel directly — more efficient than piping to grep when thousands of connections are open:

bashss -tnp 'dport = :443'     # destination portss -tnp 'sport = :22'      # source port

Filter by connection state:

bashss -tn state ESTABLISHED    # active connectionsss -tn state TIME-WAIT      # fully closed but waiting for stray late packetsss -tn state CLOSE-WAIT     # remote closed; local app has not yet called close()

Filter by address:

bashss -tn dst 192.168.1.5      # all connections to a remote hostss -tn src 192.168.1.10     # connections from a specific local address

Combine address and port filters in a single expression:

bashss -tnp dst 192.168.1.5 dport = :22

For IPv4 or IPv6 only:

bashss -tln -4    # IPv4 listening TCP socketsss -tln -6    # IPv6 listening TCP sockets

To count established connections (skip the header line before counting):

bashss -tn state ESTABLISHED | tail -n +2 | wc -l

Process Information, Recv-Q and Send-Q, and Summary Stats

The -p flag appends the process name and PID to each row:

bashsudo ss -tp

Without sudo, -p only shows process information for sockets belonging to your own user. To inspect processes across all users, elevated privileges are required.

What Recv-Q and Send-Q tell you:

• Recv-Q — bytes the kernel has received but the application has not yet read. On a listening socket, a non-zero value means the accept queue (backlog) is full and new connections may be dropped. On an established socket, it means the application is consuming data too slowly
• Send-Q — bytes sent to the remote host but not yet acknowledged. Values that are consistently non-zero indicate network congestion or a slow receiver on the other end

For a quick count of all sockets by type and state without listing individual entries, use -s:

bashss -s

This prints totals (TCP established, time-wait, UDP, etc.) in a compact summary — a fast way to spot abnormal connection counts on a busy server.

ss -tulpn handles most everyday tasks. Reach for the built-in state and address filters when the output gets too broad, and watch Recv-Q on listening sockets as an early indicator of backlog pressure. Leave a comment below if you run into any issues.