ss and netstat: Check Network Connections

Quick take: The ss command shows network sockets and connections, replacing the older netstat. The everyday command is ss -tuln to list listening TCP and UDP ports; add -p to see which process owns each.

Introduction

The ss command (socket statistics) reports on network connections and listening ports, and it is faster than the older netstat it replaces. When you need to know what is listening on a server, which process owns a port, or whether a connection is established, ss is the tool.

This guide covers listing listening ports, finding the process behind a port, filtering by state, and the equivalent netstat commands for older systems.

Syntax

The basic syntax of the ss command is:

ss [OPTIONS] [FILTER]

Common Options and Parameters

The most useful options and parameters for the ss command:

Practical Examples

Real ss commands you can run today:

# List listening TCP and UDP ports (numeric)
ss -tuln
# Show which process owns each listening port
sudo ss -tulnp
# Show all established TCP connections
ss -t state established
# Find what is listening on port 80
sudo ss -tlnp 'sport = :80'
# Summary of socket statistics
ss -s
# netstat equivalent on older systems
sudo netstat -tulnp

Diagnosing Port and Connection Problems

ss is the first tool to reach for when a service will not start or a connection is refused. The classic “address already in use” error means something is already bound to the port — ss finds it instantly.

# What is already listening on port 8080?
sudo ss -tlnp 'sport = :8080'

# Count connections by state (spot too many in TIME-WAIT)
ss -tan | awk '{print $1}' | sort | uniq -c

# All connections to a specific remote host
ss -tn dst 203.0.113.10

Combining ss with systemctl and journalctl gives a full diagnostic loop: confirm the port is free with ss, start the service with systemctl, and read why it failed with journalctl.

Tips and Best Practices

• ss -tulnp is the command to remember: TCP, UDP, listening, numeric, with process names.
• On modern distributions ss has replaced netstat; the flags are nearly identical so old habits transfer.
• To find a port hog, combine with grep: sudo ss -tulnp | grep :443.

Final Thoughts

ss is the fast, modern way to see what is happening on your network sockets — which ports are open, what is listening, and which process is responsible. Learn ss -tuln and add -p for process names, and you can diagnose “address already in use” errors and audit open ports in seconds. It complements ip for a complete networking toolkit.