ss Command in Linux: Viewing Active Connections, Sockets, Ports

The ss command on Linux is extremely useful for investigating sockets, providing various information about the network. It is the evolution of the netstat command from the old Net-tools. It is important to understand that a socket can be a network connection, as well as a Unix-type socket, which is a special file that acts as a "communication bridge" between two programs.

Its most common options are:

• -a: list all sockets;
• -r: resolve IP addresses and ports to service names;
• -n: do not resolve IP addresses and ports to services;
• -l: list only open ports (LISTEN);
• -e: show detailed information about the socket;
• -m: show the socket memory allocation;
• -p: show the process that owns the socket;
• -i: show TCP statistics about the socket;
• -K: force the closure of a socket;
• -s: show network statistics;
• -t: filter only TCP packets;
• -u: filter only UDP packets;
• -4: filter only IPv4 packets;
• -6: filter only IPv6 packets;

Some options can be combined to form a specific result.

Examples:

To view network statistics:

$ ss -sTotal: 1020TCP:   25 (estab 2, closed 1, orphaned 0, timewait 1)Transport Total     IP        IPv6RAW        1         0         1        UDP        9         6         3        TCP        24        22        2        INET       34        28        6        FRAG       0         0         0        

To view open TCP ports (LISTENING):

$ ss -ltState    Recv-Q  Send-Q   Local Address:Port     Peer Address:Port 
LISTEN     0       128    127.0.0.53%lo:domain   0.0.0.0:* 
LISTEN     0       128    0.0.0.0:ssh            0.0.0.0:* 
LISTEN     0       128    [::]:ssh               [::]:*                  

To show open TCP and UDP ports and the processes that own the sockets. To show processes, the user needs to be the root administrator:

# ss -ltpu
Netid State   Local Address
udp   UNCONN  127.0.0.1:323   users:(("chronyd",pid=20898,fd=5))
tcp   LISTEN  0.0.0.0:ssh     users:(("sshd",pid=9857,fd=3))

Shows all established connections on the ssh port (22):

$ ss -o state established '( dport = :ssh or sport = :ssh )'Netid   Recv-Q  Send-Q  Local Address:Port  Peer Address:Port           tcp       0       0     10.211.55.63:ssh    10.211.55.2:64749  timer:(keepalive,104min,0)

This command is useful for diagnosing the following problems:

• Check which network services are running (-l)
• Check the amount of memory consumed by a socket (-m)
• Check the processes that own the sockets (-p)
• Check established connections (-o state established)
• Check the volume of data traffic on a TCP connection (-i)

Learn much more about Linux in our online course. You can enroll here. If you already have an account, or want to create one, just log in or create your user here.

Liked it? Share