Master Linux Socket Stats: Essential ss Command Guide for Sysadmins

The ss command (Socket Statistics) provides detailed information about socket connections on Linux, offering more powerful and granular output than the older netstat utility.

Start with the built‑in help pages using ss -h or ss -help to explore all available options.

Basic summary view : running ss -s prints overall statistics, for example:

$ ss -s
Total: 524
TCP:   8 (estab 1, closed 0, orphaned 0, timewait 0)

Transport  Total  IP  IPv6
RAW        2      1   1
UDP        7      5   2
TCP        8      6   2
INET       17     12  5
FRAG       0      0   0

The columns represent socket categories: RAW (raw IP sockets), TCP (Transmission Control Protocol), UDP (User Datagram Protocol), INET (combined IPv4/IPv6), and FRAG (fragmented packets).

To list every socket, use ss -a. Because the output can be large, you may pipe it to wc -l to count lines, e.g., ss -a | wc -l which returned 555 lines on the author’s system.

Filter sockets by type with specific flags: ss -ta – dump all TCP sockets ss -ua – dump all UDP sockets ss -wa – dump all RAW sockets ss -xa – dump all UNIX sockets ss -4a – dump all IPv4 sockets ss -6a – dump all IPv6 sockets

Running ss without options shows only established connections. A short excerpt looks like:

$ ss | more
Netid  State  Recv-Q  Send-Q  Local Address:Port  Peer Address:Port
u_str  ESTAB  0       0       *:20863              *:20864
u_str  ESTAB  0       0       *:32232              *:33018
…

To view listening sockets, use ss -lt. If you prefer numeric ports instead of service names, add -n (e.g., ss -ltn):

$ ss -ltn
State   Recv-Q  Send-Q  Local Address:Port   Peer Address:Port
LISTEN  0       10      127.0.0.1:587       0.0.0.0:*
LISTEN  0       128     127.0.0.53%lo:53   0.0.0.0:*
LISTEN  0       128     0.0.0.0:22         0.0.0.0:*
…

For quicker usage, you can create shell aliases, for example:

$ alias listen="ss -lt"
$ alias socksum="ss -s"

These shortcuts let you invoke the most useful ss options with a single short command.