ss command in Linux: sockets and listening ports

The ss command shows network sockets: listening ports and open connections.

Syntax

ss [options]

Common cases

ss -tuln           # listening TCP and UDP ports, numeric
ss -tp             # open TCP connections with processes
ss -s              # socket summary
ss -tln | grep :22 # is anything listening on port 22

How it works: what the flags mean

The ss flags build up from letters: -t is TCP, -u is UDP, -l is listening only, -n keeps port numbers numeric (faster and clearer than names), -p shows the process holding the socket (often needs root). ss replaced netstat and reads socket data straight from the kernel, so it is faster. A socket in the LISTEN state is a server waiting for connections on its port.

Used in

You need this in the lesson Networking: inspection. The theory is the chapter Networking basics.

See also

ip addr and ip link.

Try it

Open the sandbox: a real throwaway Linux terminal in your browser. Run the commands above by hand - the container is deleted when you leave.