ss: show sockets, ports and connections

Updated November 2026

ss lists network sockets: which ports are open, which program owns them, and who is connected right now. It replaced netstat on Linux and is much faster on busy servers.

The options to remember

-t TCP, -u UDP, -l listening only, -p show the process (needs root for other users' processes), -n numbers instead of names, -a all states, -s summary. They combine into the classic ss -tulpn.

Examples

sudo ss -tulpn                          # every listening TCP and UDP port with its program
sudo ss -tlnp 'sport = :443'            # who listens on port 443
ss -tn state established                # current TCP connections
ss -tn state established '( dport = :443 or sport = :443 )'
ss -tn dst 203.0.113.0/24               # connections to a network
ss -s                                   # totals per state
ss -tan | awk 'NR>1 {print $1}' | sort | uniq -c   # connections per state
ss -tn state established | awk 'NR>1 {split($4,a,":"); print a[1]}' | sort | uniq -c | sort -rn | head   # top remote IPv4 addresses (with one state selected, ss drops the State column)

Netid State  Recv-Q Send-Q Local Address:Port  Peer Address:Port Process
tcp   LISTEN 0      511          0.0.0.0:80         0.0.0.0:*     users:(("nginx",pid=1022,fd=6))
tcp   LISTEN 0      128        127.0.0.1:5432       0.0.0.0:*     users:(("postgres",pid=880,fd=7))

A local address of 0.0.0.0 or [::] means the port is open on every interface; 127.0.0.1 means only local programs can connect. See network security for what to do with this list.

States worth knowing

• LISTEN: waiting for connections.
• ESTAB: an open connection.
• TIME-WAIT: recently closed; thousands of these are normal on busy web servers.
• CLOSE-WAIT: the other side closed but the local program has not. Many of these point to a bug or a hung application.
• SYN-RECV in large numbers can mean a SYN flood.

netstat and lsof equivalents

netstat -tulpn          # same as ss -tulpn (net-tools package)
sudo lsof -i :22        # processes using port 22
sudo lsof -i -P -n      # all network files, numeric
sudo fuser 80/tcp       # PID using TCP port 80

On macOS and the BSDs use netstat -an and lsof -i; FreeBSD also has sockstat -l. To check from the outside which ports are reachable, scan with nmap as described in security testing.