This comprehensive Linux guide expects that you run the following commands as root user but if you decide to run the commands as a different user then ensure that the user has
sudoaccess and that you precede each of the privileged commands withsudo
If you want to access the socket related information of your system, the first utility that most of the people think of is netstat. But if you want to get more information, you can use ss command for that purpose.
ss command is used to dump the socket statistics and display the information. It works similar to netstat command, but it is faster than that. You can also display even more TCP and state information than most other tools using ss command.
In this tutorial, we will explain the usage of ss command with the help of multiple examples.
General Syntax
Following is the general syntax of the ss command
root@codesposts:~$ ss [options] [ FILTER ]Displaying All Sockets With Established Connections
You can run the simple ss command without any option to display the list of all the sockets with established connections.
root@codesposts:~$ ss
NetidState Recv-Q Send-Q Local Address:Port Peer Address:Port
u_strESTAB 0 0 /run/user/1000/bus 23614 * 22709
u_strESTAB 0 0 * 20958 * 22366
u_strESTAB 0 0 /var/run/dbus/system_bus_socket 16311 * 16310
u_strESTAB 0 0 * 15593 * 16959
u_strESTAB 0 0 /run/systemd/journal/stdout 24104 * 25309
u_strESTAB 0 0 /var/run/dbus/system_bus_socket 19421 * 17398
u_strESTAB 0 0 * 30149 * 29296
u_strESTAB 0 0 * 25679 * 24115
u_strESTAB 0 0 /run/systemd/journal/stdout 30145 * 30144
u_strESTAB 0 0 * 28681 * 27327
u_strESTAB 0 0 * 23165 * 23751
u_strESTAB 0 0 @/tmp/dbus-eflm2M2S 21233 * 21232
u_strESTAB 0 0 /var/run/dbus/system_bus_socket 22712 * 22711
u_strESTAB 0 0 @/tmp/dbus-iwLZdza2Tx 20430 * 20821
u_strESTAB 0 0 * 22550 * 22174
u_strESTAB 0 0 * 25365 * 24152
u_strESTAB 0 0 /run/systemd/journal/stdout 19595 * 17359
u_strESTAB 0 0 /run/user/1000/bus 27635 * 30150
u_strESTAB 0 0 * 25665 * 23283
u_strESTAB 0 0 /run/user/1000/bus 26151 * 24354
u_strESTAB 0 0 /run/systemd/journal/stdout 21252 * 22838
u_strESTAB 0 0 /run/user/1000/bus 23607 * 21213
u_strESTAB 0 0 /run/user/1000/bus 20398 * 20813
u_strESTAB 0 0 @/tmp/dbus-lP6d8qhj 20724 * 21770
u_strESTAB 0 0 /run/systemd/journal/stdout 19547 * 18817
u_strESTAB 0 0 /var/run/dbus/system_bus_socket 16958 * 15587
u_strESTAB 0 0 * 25258 * 23259
This is a sample output of the command.
Suppressing The Header Line In Output
If you want to suppress the header line in the output of the command, you can use the option -H with the ss comamnd.
root@codesposts:~$ ss -H
u_strESTAB 0 0 /run/user/1000/bus 23614 * 22709
u_strESTAB 0 0 * 20958 * 22366
u_strESTAB 0 0 /var/run/dbus/system_bus_socket 16311 * 16310
u_strESTAB 0 0 * 15593 * 16959
u_strESTAB 0 0 /run/systemd/journal/stdout 24104 * 25309
u_strESTAB 0 0 /var/run/dbus/system_bus_socket 19421 * 17398
u_strESTAB 0 0 * 30149 * 29296
u_strESTAB 0 0 * 25679 * 24115
u_strESTAB 0 0 /run/systemd/journal/stdout 30145 * 30144
u_strESTAB 0 0 * 28681 * 27327
u_strESTAB 0 0 * 23165 * 23751
u_strESTAB 0 0 @/tmp/dbus-eflm2M2S 21233 * 21232
u_strESTAB 0 0 /var/run/dbus/system_bus_socket 22712 * 22711
u_strESTAB 0 0 @/tmp/dbus-iwLZdza2Tx 20430 * 20821
u_strESTAB 0 0 * 22550 * 22174
u_strESTAB 0 0 * 25365 * 24152
u_strESTAB 0 0 /run/systemd/journal/stdout 19595 * 17359
u_strESTAB 0 0 /run/user/1000/bus 27635 * 30150
u_strESTAB 0 0 * 25665 * 23283
u_strESTAB 0 0 /run/user/1000/bus 26151 * 24354
u_strESTAB 0 0 /run/systemd/journal/stdout 21252 * 22838
u_strESTAB 0 0 /run/user/1000/bus 23607 * 21213
u_strESTAB 0 0 /run/user/1000/bus 20398 * 20813
u_strESTAB 0 0 @/tmp/dbus-lP6d8qhj 20724 * 21770
u_strESTAB 0 0 /run/systemd/journal/stdout 19547 * 18817
u_strESTAB 0 0 /var/run/dbus/system_bus_socket 16958 * 15587
u_strESTAB 0 0 * 25258 * 23259
Displaying Only tcp Connections
If you want to display only tcp connections in the output of the command, you can use the option -t with the ss comamnd.
root@codesposts:~$ ss -tDisplaying Only udp Connections
If you want to display only udp connections in the output of the command, you can use the option -u with the ss comamnd.
root@codesposts:~$ ss -uDisplaying Only unix Connections
If you want to display only unix connections in the output of the command, you can use the option -x with the ss comamnd.
root@codesposts:~$ ss -xDisplaying All The Sockets (Listening & Non-Listening)
If you want to display all the sockets of your system (listening and non-listening), you can use the option -a with the ss comamnd.
root@codesposts:~$ ss -aDisplaying Only Listening Sockets
If you want to display only the listening sockets, you can use the option -l with the ss comamnd.
root@codesposts:~$ ss -lDisplaying The Processes Using The Sockets
If you want to display the processes that are using the sockets, you can use the option -p with the ss comamnd.
root@codesposts:~$ ss -p
Netid State Recv-Q Send-Q Local Address:Port Peer Address:Port
u_str ESTAB 0 0 * 25258 * 23259 users:(("gsd-screensaver",pid=1318,fd=2))
u_str ESTAB 0 0 * 31015 * 29464 users:(("gnome-software",pid=2178,fd=18))
u_str ESTAB 0 0 @/tmp/dbus-iwLZdza2Tx 29296 * 30149 users:(("dbus-daemon",pid=1036,fd=20))
u_str ESTAB 0 0 * 25680 * 24118 users:(("gsd-xsettings",pid=1341,fd=8))
u_str ESTAB 0 0 * 21469 * 23264 users:(("gsd-sharing",pid=1323,fd=1)) Displaying The Summary Info
If you don’t want the default output of the command, you can display a short summary of the output using the option -s with the ss comamnd.
root@codesposts:~$ ss -s
Total: 674 (kernel 0)
TCP: 3 (estab 0, closed 0, orphaned 0, synrecv 0, timewait 0/0), ports 0
Transport Total IP IPv6
* 0 - -
RAW 1 0 1
UDP 7 5 2
TCP 3 2 1
INET 11 7 4
FRAG 0 0 0 Displaying Only IPv4/IPv6 Sockets
If you want to display only the IPv4 sockets, you can use the option -4 with the ss comamnd.
root@codesposts:~$ ss -4 If you want to display only the IPv6 sockets, you can use the option -6 with the ss comamnd.
root@codesposts:~$ ss -6Not Resolving The IP Addresses To Hostnames
If you want to get a faster output from the command, you can use the option -n with the ss comamnd to prevent the command to resolve the IP addresses into the hostnames. But this will prevent resolution of port numbers as well.
root@codesposts:~$ ss -n
