/commands/ss/ss-list-listening-ports
ss -tulpn: list listening ports and the process using them
- tool
- ss / netstat
- versions
- iproute2 5.x, iproute2 6.x
- os
- linux
ss -tulpn lists every listening TCP and UDP socket with its address, port and the process that owns it. -t TCP, -u UDP, -l listening sockets only, -p show the process, -n numeric ports instead of service names. Run it with sudo to see processes owned by other users. ss replaces netstat -tulpn from the older net-tools package.
Which process uses port 80?
sudo ss -tulpn
sudo ss -ltnp 'sport = :80' # only TCP listeners on port 80
sudo ss -ltnp | grep ':5432 ' # the same with grepA typical line:
Netid State Recv-Q Send-Q Local Address:Port Peer Address:Port Process
tcp LISTEN 0 511 0.0.0.0:80 0.0.0.0:* users:(("nginx",pid=1234,fd=6))0.0.0.0:80 (or *:80, [::]:80) means the service accepts connections on every interface; 127.0.0.1:80 means only local connections. Without sudo, the Process column is empty for sockets of other users.
Reading the Local Address column
| Local Address:Port | Who can connect |
|---|---|
| 0.0.0.0:80 | Any IPv4 address of the machine, so other hosts too (if the firewall allows it). |
| [::]:80 or *:80 | Every IPv6 address; on Linux usually IPv4 as well, unless the service sets IPV6_V6ONLY. |
| 127.0.0.1:5432 | Only programs on the same machine (loopback). Typical for databases and admin ports. |
| 192.168.1.10:8080 | Only connections that arrive on that one address. |
| 127.0.0.53%lo:53 | The %lo suffix names the interface the socket is bound to; this one is systemd-resolved. |
For a listening socket, Recv-Q is the number of connections waiting to be accepted and Send-Q is the size of the backlog queue. A Recv-Q that stays close to Send-Q means the application is not accepting connections fast enough.
Options
| Option | Effect |
|---|---|
| -t / -u | TCP / UDP sockets |
| -l | Listening sockets only (default: connected sockets only) |
| -a | Both listening and connected sockets |
| -p | Show the process name, PID and file descriptor |
| -n | Do not resolve port numbers to service names |
| -4 / -6 | Only IPv4 / IPv6 |
| -s | Summary counts per protocol and state |
| -o | Show timer information (keepalive, retransmit) |
| -x | Unix domain sockets |
Filters
ss -tn state established # open TCP connections
ss -tn state established '( dport = :443 )'
ss -tn dst 203.0.113.10 # connections to one host
ss -s # totals, useful when there are thousands of socketsTypical uses
- Address already in use. Before starting a server, find what already holds the port; for certbot this is the cause of Problem binding to port 80. Stop that service or choose another port.
- After opening a firewall port. Confirm the service really listens on a public address before adding a rule with ufw allow.
- Security review. List everything listening on
0.0.0.0or[::]and close what should not be reachable from outside.
To count connections instead of listing listeners, see count connections by state.
On other systems
- macOS:
lsof -nP -iTCP -sTCP:LISTENornetstat -anv -p tcp. - Windows:
netstat -ano | findstr LISTENINGandGet-NetTCPConnection -State Listenin PowerShell; match the PID in Task Manager.
FAQ
Why is the Process column empty?
ss shows the owning process only for sockets your user may inspect. Run it with sudo to see processes of other users and system services; without root the column stays empty for them.
What is the difference between ss -tulpn and netstat -tulpn?
They show the same information. ss comes from iproute2 and reads socket data straight from the kernel through netlink, so it is faster and installed by default on current distributions, while netstat needs the older net-tools package.
A port is listening but I cannot connect from another machine. Why?
Check the Local Address column first. 127.0.0.1 or [::1] accepts only local connections. If it shows 0.0.0.0 or [::], look at the firewall (ufw, nftables, cloud security groups) next.