__ _______________________ _________._________________________ \_ _____/ \______ \ / _ \ / _____/ / _____/ | | \_ _____/ | __) | _/ / /_\ \ / \ ___ / \ ___ | | | __)_ | \ | | \ / | \ \ \_\ \ \ \_\ \ | |___ | \ \___ / |____|_ / \____|__ / \______ / \______ / |_______ \ /_______ / \/ \/ \/ \/ \/ \/ \/

ss Cheatsheet

← Back to cheatsheets

← Home

ss (socket statistics) is a modern replacement for netstat. Displays network socket information including TCP, UDP, and Unix domain sockets. Faster and more feature-rich than netstat.

Basic Usage

  • ss - All sockets
  • ss -t - TCP sockets
  • ss -u - UDP sockets
  • ss -l - Listening sockets
  • ss -a - All sockets (listening + established)
  • ss -n - Numeric addresses

Socket Types

  • -t - TCP sockets
  • -u - UDP sockets
  • -w - Raw sockets
  • -x - Unix domain sockets
  • -S - SCTP sockets
  • -D - DCCP sockets

State Filters

  • -l - Listening sockets
  • -a - All sockets
  • -s - Summary statistics
  • -e - Extended information
  • -o - Timer information
  • -m - Memory information

Address Filters

  • ss -n - No hostname resolution
  • ss -p - Show process information
  • ss -i - Internal TCP information
  • ss -K - Force close socket
  • ss -H - Suppress header

Port & Address Filters

  • ss -tlnp - TCP listening with process
  • ss -tlnp :80 - Port 80
  • ss -tlnp 'sport = :80' - Source port 80
  • ss -tlnp 'dport = :80' - Destination port 80
  • ss -tlnp 'src 192.168.1.1' - Source address
  • ss -tlnp 'dst 192.168.1.1' - Destination address

Common Examples

All Listening

ss -tlnp

TCP listening sockets with process.

All Connections

ss -tunp

TCP and UDP with process.

Specific Port

ss -tlnp :80

What's listening on port 80.

Port Range

ss -tlnp 'sport > :1024 and sport < :65535'

Ports in range.

Established Connections

ss -tn state established

Active TCP connections.

Summary

ss -s

Socket statistics summary.

Process Info

ss -tlnp

Show process using sockets.

Memory Usage

ss -m

Socket memory information.

Extended Info

ss -e

Extended socket information.

Unix Sockets

ss -xlnp

Unix domain sockets.

State Filters

  • state established - Established connections
  • state listening - Listening sockets
  • state time-wait - Time-wait state
  • state fin-wait-1 - Fin-wait-1 state
  • state fin-wait-2 - Fin-wait-2 state

Tips

  • Use -tlnp for common network troubleshooting
  • Use -p to see which process owns socket
  • Use -n for faster output (no DNS lookup)
  • Use -s for quick statistics
  • Faster than netstat
  • More detailed than netstat
  • Essential for network debugging
  • Use filters to narrow results