ssSee listening ports and open connections
ss lists the kernel's sockets: which ports are listening, on which addresses, owned by which process, and every open connection with its state and queues. It's the modern, faster replacement for netstat and the first thing to run when a port is 'already in use' or a service is unreachable.
ss [-t] [-u] [-l] [-a] [-n] [-p] [-s] [-i] [-o] [state STATE] [FILTER]You've inherited a server. List every listening port, the address it's bound to and which program owns it.
sudoNeeded to see the owning process of sockets that belong to other users.
ss asks the kernel for its socket tables over a netlink socket (the sock_diag interface), which is much faster than netstat's parsing of /proc/net/tcp on busy machines, and the kernel can apply the state and port filters itself. For each socket it prints the state (LISTEN, ESTAB, TIME-WAIT, CLOSE-WAIT...), the receive and send queues, and the local and peer address:port. With -p, ss maps each socket's inode to a process by scanning /proc/<pid>/fd/, which only works for your own processes unless you are root. For listening sockets the queue columns mean something different: Recv-Q is the number of connections completed by the kernel but not yet accept()ed by the application, and Send-Q is the maximum backlog. A local address of 0.0.0.0 or * means all interfaces; 127.0.0.1 means only local clients can connect. -i adds TCP internals such as RTT, congestion window and retransmissions.
-t / -u / -xTCP / UDP / Unix domain sockets-lListening sockets only-aAll sockets: listening and connections-nDon't resolve port numbers or addresses to names-pShow owning process name, PID and fd (root for others' sockets)-sSummary counts per protocol and state-iTCP internals: rtt, cwnd, retransmits, bytes sent/acked-oTimers: keepalive, retransmit, time-wait countdown-eExtended: socket uid and inode-4 / -6IPv4 or IPv6 sockets only-HNo header line (handy with wc -l)state SFilter by state: established, time-wait, close-wait, listening...'dport = :443'Filter by remote port (sport for local, dst/src for addresses)ss -tlp and trusting an empty Process columnWithout root, ss can only show processes you own; other users' sockets appear with no owner.
sudo ss -tlnpss -tn to find what's listeningWithout -l (or -a) ss shows only connections, never listening sockets, so the list is empty or misleading.
ss -tln # -l for listeners, -a for both"The app listens on 8080, so other servers can reach it"If the local address is 127.0.0.1:8080 it only accepts connections from the same machine, whatever the firewall says.
Check the Local Address column; bind to 0.0.0.0 (or the private IP) if it must be remote.ss -tlnp sport = :8080 without quotesUsually fine, but parentheses in bigger filters are shell syntax and break the command.
ss -tn '( dport = :443 or dport = :80 )'Try these on a Linux machine of your own. Each task has a hint and a solution.
List all listening TCP and UDP ports in this sandbox with numeric output. (In the practice sandbox ss first prints a "Cannot open netlink socket" warning, then the sockets.)
Start a throwaway listener on port 9000 in the background and confirm ss sees it with its process.
Print just the number of established TCP connections on this machine.
Write the command that shows a summary of all sockets by protocol. (The practice sandbox can't report socket totals, so it prints zeros there.)
ssSee listening ports and open connections
ss lists the kernel's sockets: which ports are listening, on which addresses, owned by which process, and every open connection with its state and queues. It's the modern, faster replacement for netstat and the first thing to run when a port is 'already in use' or a service is unreachable.
ss [-t] [-u] [-l] [-a] [-n] [-p] [-s] [-i] [-o] [state STATE] [FILTER]You've inherited a server. List every listening port, the address it's bound to and which program owns it.
sudoNeeded to see the owning process of sockets that belong to other users.
ss asks the kernel for its socket tables over a netlink socket (the sock_diag interface), which is much faster than netstat's parsing of /proc/net/tcp on busy machines, and the kernel can apply the state and port filters itself. For each socket it prints the state (LISTEN, ESTAB, TIME-WAIT, CLOSE-WAIT...), the receive and send queues, and the local and peer address:port. With -p, ss maps each socket's inode to a process by scanning /proc/<pid>/fd/, which only works for your own processes unless you are root. For listening sockets the queue columns mean something different: Recv-Q is the number of connections completed by the kernel but not yet accept()ed by the application, and Send-Q is the maximum backlog. A local address of 0.0.0.0 or * means all interfaces; 127.0.0.1 means only local clients can connect. -i adds TCP internals such as RTT, congestion window and retransmissions.
-t / -u / -xTCP / UDP / Unix domain sockets-lListening sockets only-aAll sockets: listening and connections-nDon't resolve port numbers or addresses to names-pShow owning process name, PID and fd (root for others' sockets)-sSummary counts per protocol and state-iTCP internals: rtt, cwnd, retransmits, bytes sent/acked-oTimers: keepalive, retransmit, time-wait countdown-eExtended: socket uid and inode-4 / -6IPv4 or IPv6 sockets only-HNo header line (handy with wc -l)state SFilter by state: established, time-wait, close-wait, listening...'dport = :443'Filter by remote port (sport for local, dst/src for addresses)ss -tlp and trusting an empty Process columnWithout root, ss can only show processes you own; other users' sockets appear with no owner.
sudo ss -tlnpss -tn to find what's listeningWithout -l (or -a) ss shows only connections, never listening sockets, so the list is empty or misleading.
ss -tln # -l for listeners, -a for both"The app listens on 8080, so other servers can reach it"If the local address is 127.0.0.1:8080 it only accepts connections from the same machine, whatever the firewall says.
Check the Local Address column; bind to 0.0.0.0 (or the private IP) if it must be remote.ss -tlnp sport = :8080 without quotesUsually fine, but parentheses in bigger filters are shell syntax and break the command.
ss -tn '( dport = :443 or dport = :80 )'Try these on a Linux machine of your own. Each task has a hint and a solution.
List all listening TCP and UDP ports in this sandbox with numeric output. (In the practice sandbox ss first prints a "Cannot open netlink socket" warning, then the sockets.)
Start a throwaway listener on port 9000 in the background and confirm ss sees it with its process.
Print just the number of established TCP connections on this machine.
Write the command that shows a summary of all sockets by protocol. (The practice sandbox can't report socket totals, so it prints zeros there.)