j4neiros: ss command

Thursday, August 27, 2026

A fast and powerful tool for dumping socket statistics in Linux

1. The Essential Flags

Flag	Meaning	What it does
`-t`	TCP	Shows TCP sockets
`-u`	UDP	Shows UDP sockets
`-l`	Listening	Shows only listening sockets (waiting for connections)
`-a`	All	Shows all sockets (both listening and established)
`-n`	Numeric	Skips DNS/port resolution (makes the command run much faster)
`-p`	Process	Shows the process ID (PID) and name owning the socket (requires sudo)
`-s`	Summary	Prints a quick summary of overall network statistics
`-4` / `-6`	IPv4 / IPv6	Forces ss to only show IPv4 or IPv6 connections

Show all listening ports and the processes using them:
```
sudo ss -tulpn
```
Show all active/established TCP connections:
```
ss -atn
```
Show a high-level summary of all network sockets:
```
ss -s
```

Filter by Local Port (Traffic hitting your server):
```
ss -tn 'sport = :443'
```
Filter by Remote Port (Traffic leaving your server to a specific port):
```
ss -tn 'dport = :3306'
```
Filter by Source IP (Useful if your server has multiple IP addresses):
```
ss -tn 'src 10.0.0.5'
```
Filter by Destination IP (Who the server is talking to):
```
ss -tn 'dst 192.168.1.50'
```
Combine filters (Connections from a specific IP to port 80):
```
ss -tn 'sport = :80 and dst 192.168.1.50'
```

Show only established (active) connections:
```
ss -tn state established
```
Show connections stuck in TIME-WAIT:
```
ss -tn state time-wait
```
Show connections currently listening:
```
ss -tn state listening
```

(Other valid states include: syn-sent, syn-recv, fin-wait-1, fin-wait-2, close-wait, last-ack, closing, and closed.)

Show socket memory usage (-m):
```
ss -tm
```
Useful for checking if a specific connection is hogging buffer memory.
Show TCP timer information (-o):
```
ss -to
```
Shows keepalive timers and retransmission states.
Show internal TCP metrics (-i):
```
ss -ti
```
Shows deep kernel-level data like RTT (Round Trip Time), congestion window size (cwnd), and packet pacing.