ss -H (--no-header): drop the header line when counting or parsing sockets

ss -H suppresses the header line that ss normally prints above the socket list. That makes the output safe to pipe into wc -l, awk, sort or monitoring scripts: every line is a socket, so ss -Htn state established | wc -l is exactly the number of established TCP connections. Without -H, the first line (State Recv-Q Send-Q Local Address:Port Peer Address:Port, with variations) is counted as well, and an empty result still prints one line.

Typical uses

ss -Htn state established | wc -l                       # number of established TCP connections
ss -Htn state established '( dport = :443 )' | wc -l    # ... to port 443
ss -Htln | awk '{print $3}' | sort -u                   # local listening address:port pairs
ss -Htn state time-wait | awk '{print $4}' | cut -d: -f1 | sort | uniq -c | sort -rn | head

The last line counts TIME-WAIT sockets per remote address. Note that the columns shift when a state filter is given: ss then omits the State column, so the peer address moves from field 5 to field 4. Check the column order once with the header before writing the awk program.

Related output options

Pitfalls

• Detail options wrap lines. With -i or -m, ss prints the details on a second, indented line per socket, which breaks wc -l counts. Add -O to keep one line per socket, or count without the detail options.
• Always use -n in scripts. Name resolution can make ss slow and changes column contents (https instead of 443).
• Old versions. Older iproute2 releases lack -H; there, skip the first line with tail -n +2.
• Counting by state is easier with a dedicated pattern; see count connections by state. Timers per connection come from ss -o.

All filters and columns are summarised in the ss cheat sheet; listening ports are covered in list listening ports.

FAQ