Ports & sockets: ss
ss shows which ports are open and which programs are listening on them.
Syntax
ss -tulpnNetwork services wait for connections on numbered ports — for example web servers on 80 and 443, SSH on 22. ss (the modern replacement for netstat) shows this activity.
The go-to command
ss -tulpn lists listening services. The letters mean:
t— TCP sockets.u— UDP sockets.l— only listening sockets.p— show the owning program (needs sudo).n— show numeric ports, do not resolve names.
Example
# What is listening, and which program owns it?
sudo ss -tulpn
# tcp LISTEN 0 511 0.0.0.0:80 users:(("nginx",pid=712))
# tcp LISTEN 0 128 0.0.0.0:22 users:(("sshd",pid=690))
# Which process is holding port 3000?
sudo ss -tulpn | grep :3000When to use it
- A sysadmin runs 'ss -tlnp' to list all TCP ports the server is listening on and which processes own them.
- A developer uses 'ss -tnp state established' to count active database connections from an application server.
- A security engineer uses 'ss -tulnp' to audit open ports as part of a server hardening checklist.
More examples
List listening TCP ports
Shows ss -tlnp which lists TCP listeners with process names, the modern replacement for 'netstat -tlnp'.
# -t TCP -l listening -n numeric -p process
ss -tlnp
# State Recv-Q Send-Q Local Address:Port Process
# LISTEN 0 128 0.0.0.0:80 users:(("nginx",pid=1234))
# LISTEN 0 128 0.0.0.0:443 users:(("nginx",pid=1234))Show established connections
Filters ss output to established connections and optionally narrows to a specific port for service monitoring.
# Show established TCP connections with process names
ss -tnp state established
# Filter by port (e.g. show only port 5432 postgres connections)
ss -tnp 'sport = :5432 or dport = :5432'Full audit of all open sockets
Runs ss -tulnp for a full listening port audit and ss -s for a socket count summary.
# -t TCP -u UDP -l listening -n numeric -p process
ss -tulnp
# Summary statistics
ss -s
# Total: 142
# TCP: 12 (estab 3, closed 0, orphaned 0, timewait 0)
Discussion