/cheatsheets/ss/ss-cheat-sheet
ss cheat sheet: sockets, ports and connections on Linux
The commands on this page have not been executed by our verification runner yet.updated
- tool
- ss / netstat
- versions
- iproute2 5.x / 6.x
- os
- linux
ss lists sockets on Linux. The combination used most is ss -tulpn (listening TCP and UDP ports with their processes); add sudo to see processes of other users. Everything below works with iproute2 5.x and 6.x.
Select sockets
| Command | Shows |
|---|---|
| ss | Connected (non-listening) sockets of all kinds |
| ss -t / -u / -x / -w | TCP / UDP / Unix / raw sockets |
| ss -l | Listening sockets only |
| ss -a | Listening and connected |
| ss -4 / -6 | IPv4 / IPv6 only |
| ss -tulpn | Listening TCP+UDP, numeric, with process |
| ss -tan | All TCP sockets, numeric |
Output options
| Option | Adds or changes |
|---|---|
| -n | Numeric ports and addresses (no service or host names) |
| -r | Resolve host names |
| -p | Process name, PID and file descriptor |
| -e | Extended info: uid, inode, cookie |
| -o | Timers (keepalive, on, retrans) |
| -i | TCP internals: rtt, cwnd, retransmissions, bytes |
| -m | Socket memory usage |
| -H | No header line (for scripts) |
| -s | Summary totals |
| -K | Kill matching sockets (needs root and kernel support) |
Filters
ss -tn state established
ss -tn state time-wait
ss -tn state established '( dport = :443 or sport = :443 )'
ss -tn dst 203.0.113.10
ss -tn src 192.0.2.0/24
ss -ltn 'sport = :8080'
ss -tn 'dport >= :1024'
ss -xp | grep docker.sockState names: established, syn-sent, syn-recv, fin-wait-1, fin-wait-2, time-wait, closed, close-wait, last-ack, listening, closing, plus the groups all, connected, synchronized, bucket, big. Expressions use sport, dport, src, dst with =, !=, <, >, <=, >= and combine with and, or, not and parentheses; quote them so the shell does not interpret the parentheses.
Recipes
sudo ss -ltnp 'sport = :80' # who listens on port 80
sudo ss -tnp state established '( dport = :5432 )' # which processes talk to PostgreSQL
ss -Htan | awk '{print $1}' | sort | uniq -c # count by state
ss -tni dst 203.0.113.10 # rtt and retransmits to one host
ss -tn state close-wait # sockets the application forgot to close
sudo ss -K dst 203.0.113.10 dport = :443 # drop connections to one peer (careful)Sources
Related pages
commands · ssss -tulpn: list listening ports and the process using themss -tulpn lists listening TCP and UDP ports with the owning process on Linux. What each flag means, filters for one port, and macOS and Windows equivalents.commands · ssss: count TCP connections by state, port or remote IPCount TCP connections with ss: totals with ss -s, by state with awk and uniq, per local port and per remote IP, and one state such as established or time-wait.codes · ssTCP socket states in ss and netstat: ESTAB, TIME-WAIT, CLOSE-WAIT, SYN-SENT and moreTCP states shown by ss and netstat: LISTEN, ESTAB, TIME-WAIT, CLOSE-WAIT, SYN-SENT, FIN-WAIT. What each means and when large numbers point to a problem.compare · ssss vs netstat: differences and equivalent commandsss from iproute2 replaces netstat from net-tools: faster, with built-in filters and the same flags (ss -tulpn). Equivalent commands and output differences.flags · ssss -p: show which process owns a socket (and why it is empty without root)ss -p shows which process and PID owns each socket, as in sudo ss -ltnp for listening ports. Without root, other users' processes are silently left out.