ss in Linux: See Every Open Socket

ss — socket statistics — lists every network connection and listening port on a Linux machine, with the owning process one flag away. It replaced netstat, and for the daily questions ("is it listening?", "who is connected?", "why is this port busy?") it is faster and clearer.

The everyday queries #

$ ss -tlnp
State   Recv-Q  Send-Q  Local Address:Port  Process
LISTEN  0       511     *:443               users:(("nginx",pid=812,fd=6))
LISTEN  0       128     127.0.0.1:5432      users:(("postgres",pid=930,fd=5))

The flags compose: t TCP, u UDP, l listening only, n numeric (skip DNS), p processes (needs root for other users'). That one line output answers the classic "the service won't start" — either the port is already taken (the process name is right there) or the service is bound to 127.0.0.1 instead of *.

$ ss -tn state established

Reading the columns #

Two states earn their place in memory: a pile of CLOSE-WAIT means your application is not closing sockets the peer already closed — a code bug, visible in the network layer. TIME-WAIT in volume is usually just churn: short-lived connections closing correctly.

Filters: asking narrow questions #

$ ss -tlnp 'sport = :8080'                    # who owns 8080
$ ss -tn dst 10.0.0.9                         # everything to that host
$ ss -tn state established '( dport = :443 )' # all HTTPS connections
$ ss -s                                       # summary counts by state

ss -s is the ten-second posture check — totals per state, memory used — and the first thing worth glancing at when a server "feels slow" before moving to tcpdump for packet truth.

The netstat habits, translated #

For the interface layer underneath, see ip; for testing the services above, curl. The network series continues.