ss command in Linux: sockets and ports, examples

Q: The service is running but unreachable from outside

Is it listening at all: ss -tlnp | grep :PORT. Bound to 127.0.0.1 instead of 0.0.0.0/*? Then it's local only — fix the bind address in the config. Is the port open in the firewall? (nft list ruleset / ufw status — see firewall).

Q: Not sure which process holds a connection

ss -tnp shows users:(("nginx",pid=1234,...)). For more depth, lsof.

Overview

ss (socket statistics) shows sockets: which ports are listening, which connections are established, and which process is behind them. A replacement for netstat (the net-tools package), noticeably faster with a large number of connections.

The admin's most common question is "who is listening on what":

bash

ss -tlnp        # TCP · Listening · Numeric · Process

Options

11

/

Mnemonic for the common combo -tlnp: tcp listening numeric process. -n matters on slow networks: without it ss tries to resolve every address into a name, and the output noticeably slows down. -p needs root to show other users' processes — without sudo you'll only see your own.

Option	What it does	Example
`-t`	Show TCP sockets.	`ss -t`
`-u`	Show UDP sockets.	`ss -u`
`-l`	Listening sockets only, excluding established connections.	`ss -tl`
`-n`	Do not resolve ports and addresses to names — faster, no DNS lookups.	`ss -tln`
`-p`	Show the process owning the socket; root is needed for other users' processes.	`sudo ss -tlnp`
`-a`	All sockets — both listening and established.	`ss -ta`
`-s`	Summary statistics of socket counts by type.	`ss -s`
`-4`	IPv4 only.	`ss -4tln`
`-6`	IPv6 only.	`ss -6tln`
`-o`	Show connection timers (keepalive, retransmit).	`ss -tno`
`-x`	Show unix-domain sockets instead of network ones.	`ss -x`

Nothing found. Try a shorter query.

Recipes

2

Commands

bash

ss -tlnp                          # listening TCP ports + processes
ss -ulnp                          # listening UDP ports
ss -tnp                           # established TCP connections
ss -tanp                          # all TCP: both listening and established
ss -s                             # summary: total sockets by type
ss -tnp state established         # established only
ss -tnp state time-wait          # "stuck" in TIME-WAIT
ss -tlnp '( sport = :80 or sport = :443 )'   # who's listening on 80/443
ss -tnp dst 10.0.0.5             # connections to a specific host
ss -tnp 'dport = :5432'          # connections to the postgres port
ss -tnp dst 10.0.0.0/24          # to a whole subnet
ss -tonp                          # with keepalive/retransmit timers
ss -tnp | wc -l                   # roughly how many active TCP connections

States and filters

Filter by TCP state — state <name> (or state connected/listening):

bash

ss -tan state established         # working connections
ss -tan state syn-sent            # client waiting for a reply (a stuck connect?)
ss -tan state close-wait          # app isn't closing sockets (fd leak!)
ss -tan state time-wait | wc -l   # lots of TIME-WAIT — frequent short connections

Address filters combine with and/or: src/dst (address), sport/dport (port).

bash

ss -tnp 'dst 10.0.0.5 and dport = :443'
ss -tnp 'sport >= :1024'         # ephemeral outgoing ports

Troubleshooting

5

"Address already in use" when starting a service

The port is already taken. Find who and stop/change the port:

bash

ss -tlnp 'sport = :8000'         # users:(("python",pid=1234,fd=3))

The service is running but unreachable from outside

Is it listening at all: ss -tlnp | grep :PORT.
Bound to 127.0.0.1 instead of 0.0.0.0/*? Then it's local only — fix the bind address in the config.
Is the port open in the firewall? (nft list ruleset / ufw status — see firewall).

The number of CLOSE-WAIT sockets keeps growing

The app isn't closing connections (a descriptor leak) — sooner or later you'll hit ulimit. ss -tanp state close-wait shows the culprit process.

Lots of TIME-WAIT

Normal with many short-lived client connections; usually not a problem. Fixed by keep-alive/connection pooling on the application side, not by randomly tuning the kernel.

Not sure which process holds a connection

ss -tnp shows users:(("nginx",pid=1234,...)). For more depth, lsof.

Terms

8

socket: An object through which a program interacts with the network stack or another communication mechanism. Also appears in: Unix sockets, nginx, systemd, curl and 16 more
network port: A numeric transport endpoint identifier within a host; TCP and UDP have separate port spaces.
TCP: A transport protocol providing connection establishment and an ordered byte stream. Also appears in: nmap: which ports are visible from outside, Firewall, The classic iptables firewall, nc and 13 more
UDP: A datagram transport protocol without TCP-style connection establishment. Also appears in: chrony: time synchronization over NTP, nc, nmap: which ports are visible from outside, BIND9 and 5 more
listening socket: A server socket waiting for new connections, distinct from accepted connection sockets. Also appears in: sysctl, Unix sockets
bind address: The local address to which an application binds a socket, limiting its listening scope. Also appears in: nc
connection tuple: The source/destination addresses and ports plus transport protocol.
attack surface: Everything reachable from outside: sockets listening on external addresses and ports the firewall lets through — and the services and accounts behind them. An audit starts with sudo ss -tlnp: which sockets listen and whose they are. Also appears in: nmap: which ports are visible from outside

ss — sockets and ports

Cheat sheet

Overview

Options

Recipes

Commands

States and filters

Troubleshooting

"Address already in use" when starting a service

The service is running but unreachable from outside

The number of CLOSE-WAIT sockets keeps growing

Lots of TIME-WAIT

Not sure which process holds a connection

Terms

See also