ss Command in Linux: Display Socket Statistics

A service refuses to start because something is already bound to its port, a connection hangs without returning an error, or you need to know which of the hundreds of open sockets on a busy server belongs to which process. The ss command helps investigate all three and is available by default on most Linux distributions.

ss displays socket statistics on Linux. It is the modern replacement for the deprecated netstat command and reads socket data directly from the kernel over Netlink, which makes it noticeably faster on systems with many connections. This guide explains how to list open sockets, filter by protocol, port, address, and state, read the output columns correctly, and inspect timer and round-trip details when diagnosing a slow connection.

ss Syntax #

ss [OPTIONS] [FILTER]

When invoked without options, ss displays all non-listening sockets that have an established connection.

List All Sockets #

To list all sockets regardless of state, use the -a option:

ss -a

The output includes columns for the socket type (Netid), state, receive and send queue sizes, local address and port, and peer address and port:

Netid  State   Recv-Q  Send-Q  Local Address:Port   Peer Address:Port
tcp    ESTAB   0       0       192.168.1.10:ssh      192.168.1.5:52710
tcp    LISTEN  0       128     0.0.0.0:http          0.0.0.0:*
udp    UNCONN  0       0       0.0.0.0:bootpc        0.0.0.0:*

Read the Output Columns #

The Netid column is the socket type, usually tcp, udp, u_str for a Unix stream socket, or nl for a Netlink socket.

The State column holds a standard TCP state such as ESTAB, LISTEN, TIME-WAIT, or CLOSE-WAIT. UDP does not use the TCP connection state machine, so a UDP socket that has not been connected to a peer shows UNCONN instead. That state is normal and means the socket is bound and waiting for datagrams.

Recv-Q and Send-Q are the two columns that get misread most often, because they mean different things depending on the state:

These meanings are specific to TCP. For UDP and Unix domain sockets, the values come from protocol-specific queue or memory counters, not TCP acknowledgement state.

That is why the listening socket in the output above shows a Send-Q of 128: it is a backlog limit, not a count of unacknowledged bytes. A Recv-Q that remains close to Send-Q suggests the application is not calling accept() quickly enough. When the accept queue is full, new requests may be ignored or rejected, so these columns indicate queue pressure rather than an exact count of dropped connection attempts.

Filter by Socket Type #

TCP Sockets #

To list only TCP sockets, use the -t option:

ss -t

To include listening TCP sockets as well, combine with -a:

ss -ta

UDP Sockets #

To list UDP sockets, use the -u option. Because UDP is connectionless, almost every UDP socket sits in the UNCONN state, so ss -u on its own usually prints nothing. Pair it with -a:

ss -ua

Unix Domain Sockets #

To list Unix domain sockets used for inter-process communication, use -x. The same rule applies here, so add -a to include listening sockets:

ss -xa

Show Listening Sockets #

The -l option shows only sockets that are in the listening state:

ss -tl

The most commonly used combination is -tulpn, which shows all TCP and UDP listening sockets with process names and numeric addresses:

ss -tulpn

Netid  State   Recv-Q  Send-Q  Local Address:Port  Peer Address:Port  Process
tcp    LISTEN  0       128     0.0.0.0:22           0.0.0.0:*          users:(("sshd",pid=1234,fd=3))
tcp    LISTEN  0       511     0.0.0.0:80           0.0.0.0:*          users:(("nginx",pid=5678,fd=6))
udp    UNCONN  0       0       0.0.0.0:68           0.0.0.0:*          users:(("dhclient",pid=910,fd=6))

Each option in the combination does the following:

• -t - show TCP sockets
• -u - show UDP sockets
• -l - show listening sockets only
• -p - show the process name and PID
• -n - show numeric addresses and ports instead of resolving hostnames and service names

Show Process Information #

The -p option adds the process name and PID to the output. This requires root privileges to see processes owned by other users:

sudo ss -tp

State   Recv-Q  Send-Q  Local Address:Port  Peer Address:Port  Process
ESTAB   0       0       192.168.1.10:ssh    192.168.1.5:52710  users:(("sshd",pid=2341,fd=5))

Use Numeric Output #

By default, ss resolves port numbers to service names (for example, port 22 becomes ssh). The -n option disables this and shows raw port numbers:

ss -tn

This is useful when you need to match exact port numbers in scripts or when name resolution is slow.

Filter by Port #

To find which process is listening on a specific port, filter by the local source port. For example, the following command checks port 80 without also matching ports such as 8080:

sudo ss -tulpn 'sport = :80'

You can also use the built-in filter syntax:

ss -tnp 'dport = :443'

To filter by source port:

ss -tnp 'sport = :22'

Filter by Connection State #

ss supports filtering by connection state. Common states include ESTABLISHED, LISTEN, TIME-WAIT, and CLOSE-WAIT.

To show only established TCP connections:

ss -tn state ESTABLISHED

To show only sockets in the TIME-WAIT state:

ss -tn state TIME-WAIT

Alongside the individual states, ss accepts several group keywords that save a long or expression:

• all - every state
• connected - all states except listening and closed
• synchronized - all connected states except syn-sent
• bucket - the minisocket states, meaning time-wait and syn-recv
• big - the opposite of bucket

To see every TCP socket except listeners and closed sockets:

ss -tn state connected

Filter by Address #

To show sockets connected to or from a specific IP address:

ss -tn dst 192.168.1.5

To filter by source address:

ss -tn src 192.168.1.10

You can combine address and port filters:

ss -tnp dst 192.168.1.5 dport = :22

Show IPv4 or IPv6 Only #

To restrict output to IPv4 sockets, use -4:

ss -tln -4

To show only IPv6 sockets, use -6:

ss -tln -6

Show Summary Statistics #

The -s option prints a summary of socket counts by type and state without listing individual sockets:

ss -s

Total: 312
TCP:   14 (estab 4, closed 3, orphaned 0, timewait 3)

Transport Total  IP   IPv6
RAW       1      0    1
UDP       6      4    2
TCP       11     7    4
INET      18     11   7
FRAG      0      0    0

This is useful for a quick overview of the network state on a busy server.

Show Timers and Socket Details #

A plain socket list tells you that a connection exists, but it provides little context for a slow or stuck connection. Four options add details that help narrow the cause.

The -o option shows timer information for each socket:

ss -tno

State  Recv-Q  Send-Q  Local Address:Port  Peer Address:Port   Timer
ESTAB  0       0       192.168.1.10:22     192.168.1.5:52710   timer:(keepalive,18min,0)
ESTAB  0       4096    192.168.1.10:443    203.0.113.25:51422  timer:(on,1.320ms,3)

The Timer column reads as timer:(name,expire,retrans). A keepalive timer on an idle connection is normal housekeeping. An on timer means that a TCP retransmission, early retransmission, or tail loss probe timer is active, and the third field reports how many retransmissions have occurred. In the second row, the value 3 shows retransmission activity while the non-zero Send-Q shows that data remains in the send queue. These values point to a delivery problem, but they do not identify whether the cause is the local host, the network path, or the peer.

The -i option prints internal TCP information, including the round-trip time and the congestion window:

ss -tin

ESTAB  0  0  192.168.1.10:443  203.0.113.25:51422
     cubic wscale:7,7 rto:236 rtt:33.5/12.25 mss:1448 cwnd:10 bytes_sent:12043 bytes_acked:12043 retrans:0/2

rtt:33.5/12.25 is the smoothed round-trip time in milliseconds followed by its mean deviation, cwnd is the congestion window in segments, and retrans:0/2 is the current and total retransmission count. A congestion window that remains small while the total retransmission count climbs can indicate packet loss or congestion. Compare repeated samples before drawing a conclusion from a single connection.

The -m option adds socket memory usage, which is worth checking when a process holds far more buffer space than you expect:

ss -tm

The -e option shows extended information, including the owning UID, the socket inode, and the socket cookie:

ss -te

These options combine, so sudo ss -tiepmo prints everything at once for TCP sockets. For a first pass at a latency complaint, -o and -i are usually enough on their own.

Format Output for Scripts #

Three options make ss output easier to parse when you pipe it into something else:

• -H - suppress the header line
• -O - print each socket on a single line
• -Q - suppress the Recv-Q and Send-Q columns

-H removes the need to strip the header with tail or awk. To count the remote addresses with the most open connections, ranked:

ss -tnH state connected | awk '{print $5}' | sed 's/:[0-9]*$//' | sort | uniq -c | sort -rn

The sed step removes the trailing port so that IPv4 and IPv6 peers group correctly by address.

-O matters as soon as you add -i or -m, because those options normally print their detail on a wrapped second line. With -O, each socket stays on one line and line-oriented tools keep working:

ss -tinO state connected

Practical Examples #

The following examples cover common diagnostics you will use together with tools like ip , ifconfig , and check listening ports .

Find which process is listening on port 8080:

sudo ss -tlpn sport = :8080

List all established SSH connections to your server:

ss -tn state ESTABLISHED '( dport = :22 or sport = :22 )'

Show all connections to a remote host:

ss -tn dst 203.0.113.10

Count established TCP connections:

ss -tnH state ESTABLISHED | wc -l

netstat to ss Option Mapping #

Most netstat habits carry over directly, because ss reuses the same short options for protocol and display selection. The routing and interface parts of netstat are not part of ss at all and moved to the ip command instead.

Two differences catch people out. Both tools show the owning process with -p, but ss prints it as users:(("nginx",pid=5678,fd=6)) rather than the 5678/nginx format that netstat uses, so existing awk and cut pipelines need adjusting. Also, ss -s returns a short socket count summary rather than the per-protocol counters from netstat -s. The nstat -az command shows the absolute kernel counters, including counters whose current value is zero.

For the other side of the comparison, see the netstat command guide.

Quick Reference #

For a printable quick reference, see the ss cheatsheet .

Troubleshooting #

ss: command not found
ss ships in the iproute2 package, which is installed by default on nearly every current distribution but is often missing from minimal container images. On Ubuntu, Debian, and derivatives, install it with sudo apt install iproute2. On Fedora, RHEL, and derivatives, use sudo dnf install iproute.

ss -p does not show process names
Process information for sockets owned by other users requires elevated privileges. Use sudo ss -tp or sudo ss -tulpn.

Filters return no results
Use quoted filter expressions such as ss -tn 'dport = :443', and verify whether you should filter by sport or dport.

Service names hide numeric ports
If output shows service names (ssh, http) instead of port numbers, add -n to keep numeric ports and avoid lookup ambiguity.

Output is too broad on busy servers
Start with protocol and state filters (-t, -u, state connected) and then add address or port filters to narrow results.

Extended output breaks a script
-i and -m wrap their detail onto a second line. Add -O to keep each socket on a single line, and -H to drop the header.

You need command-level context, not only sockets
Use ss with ps or pgrep when you need additional process detail.

FAQ #

What is the difference between ss and netstat?
ss is the modern replacement for netstat. It reads directly from kernel socket structures, making it significantly faster on systems with many connections. netstat is part of the net-tools package, which is deprecated and not installed by default on most current distributions.

Why do I need sudo with ss -p?
Without root privileges, ss can only show process information for sockets owned by your own user. To see process names and PIDs for all sockets, run ss with sudo.

What do Recv-Q and Send-Q mean in the output?
For TCP listeners, Recv-Q is the number of connections waiting to be accepted and Send-Q is the accept queue limit. For other TCP states, the columns show unread received bytes and data that remains unacknowledged. UDP and Unix domain sockets use protocol-specific queue or memory counters.

How do I find which process is using a specific port?
Run sudo ss -tulpn 'sport = :80', replacing 80 with the port you want to inspect. The -p option adds process information, and the built-in source-port filter avoids partial matches such as 8080.

Conclusion #

ss is the standard tool for inspecting socket connections on modern Linux systems. The -tulpn combination covers most day-to-day needs, while state and address filters narrow the output and -o together with -i adds context for diagnosing slow connections. For related network diagnostics, see the ip and ifconfig command guides, or check listening ports for a broader overview.

About the authors

Dejan Panovski

Dejan Panovski is the founder of Linuxize, an RHCSA-certified Linux system administrator and DevOps engineer based in Skopje, Macedonia. Author of 1000+ Linux tutorials with 20+ years of experience turning complex Linux tasks into clear, reliable guides.

View author page