ss — ports, sockets and connections

ss displays socket information from the Linux networking stack. It is commonly used to identify listening services, active TCP connections, UDP sockets and the processes associated with network ports.

A common combination is -lntp: listening sockets, numeric addresses, TCP and process information.

-l limits output to listening sockets. Combine it with t for TCP or u for UDP.

-p shows which process owns the socket when permissions allow it.

-n prevents service-name and hostname resolution. Instead of displaying ssh or https, ss shows the raw port numbers 22 and 443. This is usually clearer during troubleshooting.

Without -l, ss can display established and transitional network connections.

Socket states can be filtered directly to focus on active sessions.

LISTEN means a service is waiting for connections. ESTABLISHED represents an active connection. TIME-WAIT appears after a connection closes while TCP waits before fully releasing the socket. SYN-SENT and SYN-RECV represent connection establishment.

ss supports expressions that filter sockets by source or destination port.

For quick interactive checks, ss output is often piped into grep.

-4 restricts output to IPv4 and -6 restricts it to IPv6.

A service bound to 127.0.0.1 is normally accessible only locally. 0.0.0.0 means the service listens on all IPv4 interfaces. [::] commonly indicates all IPv6 interfaces and may also accept IPv4 depending on system configuration.

During Linux troubleshooting or authorised host enumeration, this command gives a fast overview of exposed network services and their processes.