SS Command Guide for Beginners

SS command is a useful Linux networking tool that helps you inspect network connections, open ports, and active sockets on a server. If you manage a Linux system, troubleshoot connectivity problems, or want to see which services are listening for connections, ss is one of the most practical commands to know.

The command is fast, flexible, and available on most modern Linux distributions. It also provides much of the functionality that administrators previously used the netstat command for.

This guide explains how ss works and shows practical examples you can use on a Linux server.

What Is the SS Command?

The name ss stands for socket statistics.

A socket represents one endpoint of a network connection. Applications use sockets to communicate over protocols such as TCP and UDP.

For example, when a web server listens for HTTPS traffic on port 443, Linux creates a socket associated with that service. When a user connects to the website, the operating system creates additional sockets for the active connections.

The SS command allows you to view this information directly from the command line.

You can use it to check:

• Active network connections
• Listening ports
• TCP and UDP sockets
• Processes using network ports
• IPv4 and IPv6 connections
• Connection states
• General socket statistics

This makes it especially useful when troubleshooting Linux servers.

Basic SS Command Syntax

The basic syntax is simple:

ss [options]

Running the command without additional options displays active socket information:

ss

The output may include several columns, such as:

Netid  State  Recv-Q  Send-Q  Local Address:Port  Peer Address:Port

Here is what they generally mean:

Netid shows the socket type or protocol.

State displays the current connection state.

Recv-Q shows data waiting to be received by the application.

Send-Q shows data waiting to be sent.

Local Address:Port identifies the local IP address and port.

Peer Address:Port identifies the remote system connected to the server.

For a busy server, the default output can contain a large amount of information. This is why administrators usually combine the SS command with specific options.

Check All Network Connections

To display both listening and non-listening sockets, use:

ss -a

The -a option stands for all.

This is useful when you want a broad overview of network activity on the system.

However, the result can be long on servers with many active connections.

Check TCP Connections

To display TCP sockets, run:

ss -t

TCP is used by many common services, including:

• HTTP
• HTTPS
• SSH
• FTP
• Email protocols

To display all TCP sockets, including listening ones, use:

ss -ta

This can help when troubleshooting applications that rely on TCP connections.

Check UDP Connections

To display UDP sockets, use:

ss -u

To show all UDP sockets:

ss -ua

UDP works differently from TCP because it does not establish connections in the same way. DNS, for example, commonly uses UDP for standard queries.

As a result, UDP output may look different from TCP connection information.

Check Listening Ports

One of the most useful features of the SS command is checking which ports are listening for incoming connections.

Run:

ss -l

The -l option displays listening sockets.

You can combine it with TCP:

ss -lt

Or UDP:

ss -lu

This is useful when you need to confirm that a service is actually listening on the expected port.

For example, if an SSH service should listen on port 22, the output may contain something similar to:

LISTEN  0  128  0.0.0.0:22  0.0.0.0:*

That indicates that a service is listening on TCP port 22.

Display Port Numbers Instead of Service Names

By default, Linux may translate some port numbers into service names.

For example, port 22 might appear as ssh.

To display numerical ports and IP addresses instead, use:

ss -n

The -n option disables name resolution.

Administrators often combine it with other options:

ss -tuln

This command displays TCP and UDP listening sockets using numerical addresses and port numbers.

It is one of the most useful combinations for basic server troubleshooting.

Find Which Process Uses a Port

Sometimes you know that a port is open but need to identify the application using it.

Use the -p option:

ss -p

A more practical version is:

sudo ss -tulpn

This command displays:

• TCP sockets
• UDP sockets
• Listening ports
• Process information
• Numerical addresses and ports

You may need sudo to see complete process details.

For example, you might see information showing that nginx is listening on port 443 or that sshd is listening on port 22.

This makes the command particularly useful when investigating unexpected open ports.

Check a Specific Port

You can also filter the output for a particular port.

For example, to check port 443:

ss -tuln | grep :443

If a service is listening on that port, you should see a matching entry.

You can perform the same check for other common ports:

ss -tuln | grep :22

ss -tuln | grep :80

ss -tuln | grep :53

This is a quick way to confirm whether SSH, HTTP, HTTPS, DNS, or another service is listening.

View Established Connections

TCP connections can exist in several states.

One of the most important is ESTABLISHED, which indicates that two systems currently have an active TCP connection.

To display established connections, run:

ss -t state established

This can help you see which remote systems are currently communicating with your server.

You may also combine it with numerical output:

ss -tn state established

On public servers, you may see many established connections during normal operation.

Show a Socket Summary

If you do not need details about every connection, ss can provide a quick summary:

ss -s

The output shows statistics for different socket types and TCP states.

This is helpful when you want a fast overview of network activity without reading hundreds of individual connections.

Check IPv4 and IPv6 Connections

You can limit the output of the SS command to a specific IP version.

For IPv4:

ss -4

For IPv6:

ss -6

You can combine these options with others.

For example:

ss -4 -tuln

This displays listening TCP and UDP sockets that use IPv4.

For IPv6:

ss -6 -tuln

These commands can be useful when troubleshooting servers configured for both IP versions.

SS vs Netstat

Linux administrators traditionally used netstat to inspect network connections and listening ports.

Today, many modern distributions recommend ss instead.

The main reason is that the SS command belongs to the modern iproute2 networking toolkit and can retrieve socket information more efficiently.

Both commands can perform many similar tasks, but ss is typically available by default on current Linux systems, while netstat may require installing the older net-tools package.

For new Linux users, learning ss first generally makes more sense.

Useful SS Command Examples

Here are several commands worth remembering:

ss -tuln

Show TCP and UDP listening ports.

sudo ss -tulpn

Show listening ports and the processes using them.

ss -tn

Show active TCP connections without resolving names.

ss -t state established

Show established TCP connections.

ss -s

Display a summary of socket statistics.

These commands cover many everyday server troubleshooting tasks.

Conclusion

The SS command gives Linux users a fast way to inspect network connections, sockets, listening ports, and the services using them.

For beginners, the most useful command to remember is:

sudo ss -tulpn

It provides a clear overview of the TCP and UDP services currently listening on a server and shows which processes are responsible for them.

As you become more comfortable with Linux networking, you can combine additional options and filters to investigate specific ports, connection states, protocols, and IP versions.

Whether you are checking why a service is unreachable, confirming that a server is listening on the correct port, or investigating active connections, it is a valuable tool for everyday Linux server administration.