ss

ss (“socket statistics”) is the iproute2 replacement for netstat on Linux. It dumps socket state directly from the kernel via the NETLINK_SOCK_DIAG netlink interface instead of walking /proc/net/*, which makes it dramatically faster on hosts with many sockets and lets it expose more TCP internals (timers, congestion window, memory) than netstat ever could. Written by Alexey Kuznetsov.

Core flags

Flag	Effect
-t	TCP sockets
-u	UDP sockets
-x	UNIX domain sockets
-l	Listening sockets only (default is established/other)
-a	All sockets — listening and non-listening
-n	Numeric output: raw port numbers, no service-name resolution
-p	Show the owning process (users:(("name",pid=N,fd=M))) — needs root to see other users’ processes
-e	Extended socket info (uid, inode, skmem)
-i	Internal TCP info (rtt, cwnd, retransmits)
-o	Timer info (keepalive, retransmission state)
-s	Summary statistics per protocol

The canonical triage one-liner — every open TCP/UDP listener with its owning process, no DNS stalls:

ss -tulpn

Filtering

ss has a real query language netstat lacks — state and address filters compose:

ss -o state established '( dport = :ssh or sport = :ssh )'
ss -t state time-wait
ss -x src /tmp/.X11-unix/*          # processes connected to the X server
ss -t dst 10.0.0.0/8

State names (established, syn-sent, fin-wait-1, time-wait, …) follow the TCP state machine of RFC 793.

Operational notes

• On a modern Linux foothold, prefer ss over netstat — iproute2 is present on every current distro, while net-tools (netstat) is increasingly not installed. The output columns are nearly identical, so netstat muscle memory transfers directly.
• -p silently omits process info for sockets you don’t own when run unprivileged — if the Process column looks empty, escalate.
• Pair with netstat knowledge for cross-platform triage: Windows has netstat and Get-NetTCPConnection, not ss.

Sources

• ss(8) — Linux manual page

Related

• netstat — the predecessor, still universal on Windows
• udp — -u output and UDP’s stateless rows
• linux-reconnaissance-commands — host triage toolkit