How to Use ss Command in Linux: Syntax and Examples

The ss command in Linux shows detailed information about network sockets and connections. Use ss [options] to list active TCP, UDP, or other socket types quickly and efficiently.

Syntax

The basic syntax of the ss command is:

• ss [options]: Runs the command with specified options.
• -t: Show TCP sockets.
• -u: Show UDP sockets.
• -l: Show listening sockets only.
• -a: Show all sockets (listening and non-listening).
• -p: Show process using the socket.
• -n: Show numeric addresses instead of resolving names.

bash

ss [options]

Example

This example shows how to list all listening TCP sockets with process info and numeric addresses:

bash

ss -tlnp

Output

State      Recv-Q Send-Q Local Address:Port               Peer Address:Port  
LISTEN     0      128    0.0.0.0:22                      0.0.0.0:*      users:("sshd",pid=1234,fd=3)
LISTEN     0      128    [::]:80                         [::]:*         users:("nginx",pid=2345,fd=6)

Common Pitfalls

Common mistakes when using ss include:

• Not using -n causes slow output due to DNS lookups.
• Omitting -p means you won't see which process owns the socket.
• Forgetting -l when you want only listening sockets shows too many entries.

Wrong way (slow and less info):

ss -t

Right way (fast and detailed):

ss -tlnp

bash

ss -t
ss -tlnp

Quick Reference

Option	Description
-t	Show TCP sockets
-u	Show UDP sockets
-l	Show listening sockets only
-a	Show all sockets
-p	Show process using socket
-n	Show numeric addresses

Key Takeaways

Use ss to quickly view active network connections and sockets.

Add -t, -u, -l, -p, and -n options to customize output.

Use -n to avoid slow DNS lookups and speed up results.

Include -p to see which process owns each socket.

Remember -l to filter only listening sockets when needed.