hakk

Understanding the ss Command: A Modern Alternative to netstat

The ss command (short for socket statistics) is a fast, feature-rich replacement for the older netstat utility. It allows administrators to inspect and manage network sockets on a system — whether they’re TCP, UDP, RAW, or UNIX domain sockets. Compared to netstat, ss runs faster and provides more filtering options, making it invaluable for network diagnostics and system monitoring.

Show All TCP, UDP, RAW, and UNIX Sockets

ss -a -t -u -w -x

Motivation: Network administrators often need a complete snapshot of all active sockets — to check which services are listening, what connections are established, or to detect unusual activity.

Explanation:

Tip: Use -n to skip DNS lookups for faster output:

ss -antuwx

Example Output:

Netid State  Recv-Q Send-Q Local Address:Port Peer Address:Port
tcp   ESTAB  0      0      192.168.1.5:ssh   192.168.1.10:33842
udp   UNCONN 0      0      0.0.0.0:bootpc    0.0.0.0:*
unix  STREAM 0      0      /run/user/1000/bus 0

Filter TCP Sockets by Connection State

ss -t state established
ss -t state all exclude established

Motivation: Understanding the state of TCP connections (for example, SYN-SENT, ESTAB, TIME-WAIT) helps identify network congestion, failed connections, or excessive retries.

Explanation:

Example Output:

Netid State    Recv-Q Send-Q Local Address:Port Peer Address:Port
tcp   SYN-SENT 0      1      192.168.1.5:40065 203.0.113.1:http

Show All TCP Sockets Listening on Port 8080

ss -lt src :8080

Motivation: Port 8080 is often used for web servers and development environments. Administrators can use this command to confirm that services are listening correctly.

Explanation:

Example Output:

Netid State  Recv-Q Send-Q Local Address:Port Peer Address:Port
tcp   LISTEN 0      128    0.0.0.0:http-alt   0.0.0.0:*

Show All TCP Connections to a Remote SSH Server

ss -pt dst :22

Motivation: List all processes with active SSH connections — useful for security audits or session tracking.

Explanation:

Example Output:

Netid State Recv-Q Send-Q Local Address:Port  Peer Address:Port  Process
tcp   ESTAB 0      0      192.168.1.5:35022  192.168.1.10:ssh   users:(("ssh",pid=10293,fd=10))

Show UDP Sockets Matching Source and Destination Ports

ss -u "( sport = :12345 and dport = :17000 )"

Motivation: In UDP-based applications (such as VoIP, DNS, or streaming), isolating traffic by ports helps diagnose packet loss or latency.

Explanation:

Example Output:

Netid State Recv-Q Send-Q Local Address:Port Peer Address:Port
udp   UNCONN 0     0     192.168.1.5:12345   203.0.113.2:17000

Show All TCP IPv4 Sockets Within a Subnet

ss -4t src 192.168/16

Motivation: Useful for examining internal LAN traffic and verifying that connections stay within the expected subnet.

Explanation:

Example Output:

Netid State Recv-Q Send-Q Local Address:Port Peer Address:Port
tcp   ESTAB 0      0      192.168.2.3:http   192.168.1.5:40210

Killing a Socket Connection Safely

The --kill flag allows administrators to forcibly close a socket on the local machine. This requires root privileges. It cannot terminate sockets on remote hosts; it only affects connections local to the system.

Example 1 — Killing a Client Connection

If your system is the client, ss might show:

Netid State Recv-Q Send-Q Local Address:Port   Peer Address:Port
tcp   ESTAB 0      0      0.0.0.0:8080         1.1.1.1:32123

To close this connection:

sudo ss --kill src 1.1.1.1 dport = 8080

or equivalently:

sudo ss --kill dst 127.0.0.1 sport = 32123 dport = 8080

Example 2 — Killing a Server-Side Connection

If your system is the server listening on port 8080:

sudo ss --kill src 192.168.1.17 dport = 8080

Explanation:

Example Output:

Killed connection: 192.168.1.17:32123

Common ss Command Cheat Sheet

PurposeCommandNotes
Show all socketsss -antuwxCombine flags for all protocols; add -n to disable DNS lookups
List listening TCP portsss -ltShows only sockets in LISTEN state
List established TCP connectionsss -t state establishedFilters by active TCP sessions
List UDP socketsss -u -aDisplays both listening and active UDP sockets
Show sockets for a specific portss -t '( sport = :22 or dport = :22 )'Works for any port (replace 22)
Show sockets to a specific IPss -t dst 203.0.113.5Filter by destination IP address
Show sockets within a subnetss -4t src 192.168/16Useful for LAN/internal traffic
Include process infosudo ss -ptRequires root privileges
Exclude certain statesss -t state all exclude time-waitFilters out unwanted states
Kill client-side connectionsudo ss --kill src 192.168.1.17 sport = 32123Terminate specific socket (requires root)
Kill server-side connectionsudo ss --kill dst 192.168.1.17 dport = 8080Close connection from server’s perspective
Show connection statsss -sSummarizes socket usage by protocol
Watch sockets in real timewatch -n 1 'ss -ant'Refresh every second for live view

Tips

Quick Mental Map

Conclusion

The ss command provides a detailed, efficient, and scriptable way to inspect socket connections. It supports advanced filtering, process correlation, and even direct connection termination — all faster than legacy tools like netstat.

Whether you’re diagnosing latency, managing TCP states, or dropping unwanted sessions, mastering ss is essential for any Linux system administrator.