ss Cheatsheet
Quick reference for listing sockets, listening ports, connection states, and process owners with the ss command
The ss command displays socket statistics on Linux and is the modern replacement for netstat. This cheatsheet covers the most useful ss flags, state and address filters, and common troubleshooting patterns.
Basic Syntax
Core ss command forms and output controls.
| Command | Description |
|---|---|
ss | Show non-listening sockets with an established connection |
ss -a | Show all sockets, listening and non-listening |
ss -n | Show numeric addresses and ports, no name resolution |
ss -p | Show the process that owns each socket |
ss -s | Show a summary of socket counts by type and state |
Filter by Protocol
Restrict output to a single socket family.
| Command | Description |
|---|---|
ss -t | TCP sockets |
ss -u | UDP sockets |
ss -x | Unix domain sockets |
ss -ta | All TCP sockets, including listening |
ss -4 | IPv4 sockets only |
ss -6 | IPv6 sockets only |
Listening Ports
Find services that are accepting connections.
| Command | Description |
|---|---|
ss -l | Show listening sockets only |
ss -tl | Listening TCP sockets |
ss -ul | Listening UDP sockets |
ss -tulpn | Listening TCP/UDP with process and numeric output |
sudo ss -tlpn 'sport = :80' | Find the process listening on TCP port 80 |
Connection State Filters
Narrow output to a specific TCP state.
| Command | Description |
|---|---|
ss -tn state ESTABLISHED | Established TCP connections |
ss -tn state listening | Listening TCP sockets |
ss -tn state TIME-WAIT | Connections in TIME-WAIT |
ss -tn state CLOSE-WAIT | Connections in CLOSE-WAIT |
ss -tn state ESTABLISHED | tail -n +2 | wc -l | Count established TCP connections |
Address and Port Filters
Match sockets by source or destination.
| Command | Description |
|---|---|
ss -tnp 'dport = :443' | Filter by destination port |
ss -tnp 'sport = :22' | Filter by source port |
ss -tn dst 192.168.1.5 | Filter by remote address |
ss -tn src 192.168.1.10 | Filter by local address |
sudo ss -tlpn sport = :8080 | Find the process listening on port 8080 |
Process and Statistics
Tie sockets to processes and read summary counts.
| Command | Description |
|---|---|
sudo ss -tp | TCP sockets with process name and PID |
sudo ss -tulpn | Listening sockets with owning processes |
ss -s | Total sockets by transport and state |
ss -tn | TCP sockets with numeric addresses |
ss -tn dst 203.0.113.10 | All connections to a remote host |
netstat to ss Translation
Map old netstat commands to their ss equivalents.
| netstat Command | ss Command |
|---|---|
netstat -tuln | ss -tuln |
sudo netstat -tulnp | sudo ss -tulpn |
netstat -at | ss -ta |
netstat -ant | grep ESTABLISHED | ss -tn state ESTABLISHED |
netstat -s | ss -s |
Troubleshooting
Common ss issues and quick fixes.
| Issue | Check |
|---|---|
-p shows no process | Run with sudo to see sockets owned by other users |
| Filters return nothing | Quote the expression and verify sport versus dport |
| Service names hide ports | Add -n to keep numeric ports |
| Output too broad | Start with -t, -u, or a state filter, then narrow |
| Port match too broad | Use a built-in filter, such as ss -tlpn 'sport = :80' |
Related Guides
Use these guides for full walkthroughs and related tools.
| Guide | Description |
|---|---|
ss Command in Linux | Full ss guide with examples |
netstat Command in Linux | The legacy tool ss replaces |
ip Command in Linux | Modern routes and interface management |
| How to Check Listening Ports in Linux | Compare ss, netstat, and lsof |
lsof Command in Linux | Tie sockets and files back to processes |