ss

ss -tlnp answers "is the server listening, on which address and port, and which program?". The local address matters: 127.0.0.1:80 accepts only connections from the device itself, *:80 or 0.0.0.0:80 from anywhere. ss -tan shows every TCP connection with its state (ESTAB, SYN-SENT, TIME-WAIT…), and ss -ti adds TCP's internals: RTT, congestion window, retransmissions.

ss command usage

ss [-t] [-u] [-l] [-n] [-p] [-a] [-o] [-i] [state STATE] [FILTER]
FILTER: 'sport = :PORT', 'dport = :PORT', dst ADDRESS, src ADDRESS, joined with and, or, not and ( )

Options

-t / -u

TCP / UDP sockets

-l

only listening sockets

-n

numbers, not service names

-p

the program that owns each socket

sport = :8080

only sockets whose own (local) port is the one after it

-a

all: listening and connected

state time-wait

only connections in that state

dport = :80

only sockets whose peer's (remote) port is the one after it

-o

each connection's timer: retransmit, keepalive or persist, and when it fires

dst 10.0.2.10

only sockets whose peer is the address after it (or a network, 10.0.2.0/24)

-i

TCP internals: rtt, cwnd, retransmits

ss examples

ss -tlnp

Lists the TCP ports this device listens on, with the program behind each.

ss -ulnp

Lists the UDP ports this device listens on.

ss -tan

Lists every TCP connection with its state.

ss -tn state time-wait

Lists the connections that were closed and are waiting out TIME_WAIT.

ss -tin '( dport = :5201 )'

Shows RTT, congestion window and retransmits of connections to port 5201.

ss -tulpn

Lists every listening TCP and UDP port with its program: the old netstat -tulpn.

ss -tnp

Lists established TCP connections with the program that owns each.

ss -s

Prints totals: how many sockets of each kind, and TCP connections by state.

ss -tn dst 10.0.2.10

Lists only the connections to 10.0.2.10.

ss -tln 'sport = :22'

Checks that something listens on port 22.

ss -tn state established '( dport = :443 or sport = :443 )'

Lists established HTTPS connections, in and out.

ss -tn state syn-sent

Lists connections still waiting for an answer to their SYN: a sign that a firewall drops them.

ss -H -tn state established | wc -l

Counts the established connections; -H leaves out the header line.

ss -tno

Adds each connection's timers: the retransmit or keepalive timer and when it fires.

ss -K dst 10.0.2.10 dport = :22

Closes the matching connections by force (needs root and a kernel with socket destroy).

ss -xl

Lists the listening Unix sockets, such as the ones a database or Docker uses.

Reading the output

$ ss -tlnp
State  Recv-Q Send-Q Local Address:Port  Peer Address:PortProcess
LISTEN 0      4096               *:5201             *:*    users:(("iperf3",pid=32,fd=3))
LISTEN 0      1                  *:7                *:*    users:(("nc",pid=20,fd=3))
LISTEN 0      9                  *:80               *:*    users:(("httpd",pid=18,fd=3))

• *:80: listening on port 80 on every address. 127.0.0.1:80 would refuse everyone but the device itself.
• users:(("httpd",…)): the program. Nothing on the port you expected: the service is not running.
• In ss -tan, many SYN-SENT means connections that get no answer; Recv-Q growing means the program does not read.

Pitfalls

• Listening is not reachable: a firewall can still drop connections to a port ss shows as LISTEN.

Run it on real machines