Master Linux Socket Inspection with the ss Command – Quick Options and Examples

If you need to inspect socket information on a Linux system, the first tool that comes to mind is often netstat, but ss provides more detailed and faster output.

Show All Established Connections

Running ss without any options lists every established socket:

# ss

Suppress Header Line

Use the -H option to hide the column headers:

# ss -H

Filter by Protocol

TCP only: ss -t UDP only: ss -u UNIX sockets only:

ss -x

# ss -t

# ss -u

# ss -x

Show Only Listening Sockets

The -l flag restricts output to sockets in the LISTEN state:

# ss -l

Display Summary Statistics

Adding -s provides a concise summary of socket usage:

# ss -s
Total: 156
TCP:   3 (estab 1, closed 0, orphaned 0, timewait 0)

Transport  Total  IP  IPv6
RAW        1      0   1
UDP        3      2   1
TCP        3      2   1
INET       7      4   3
FRAG       0      0   0

Show Only IPv4 or IPv6 Listening Sockets

IPv4 listening sockets: ss -4 -l IPv6 listening sockets:

ss -6 -l

# ss -4l

# ss -6l

Prevent DNS Resolution

Use -n to keep IP addresses from being resolved to hostnames (note that port numbers will also stay numeric):

# ss -n -4l

These options allow you to tailor the ss output to the exact information you need, making it a powerful replacement for netstat in everyday Linux network troubleshooting.