How to use the ss command on Linux to audit network connections

Why retire netstat and adopt ss on Linux

For decades, system administrators relied on the netstat command to inspect network traffic and check which ports were open on a Linux server. However, with the massive growth of the internet and servers handling tens of thousands of concurrent connections, netstat began to show performance bottlenecks. It scans slow virtual directories to gather data, consuming significant memory and CPU under stress. This is precisely where the ss utility emerges as the natural and modern successor.

In practice, the ss command—short for socket statistics—communicates directly with the operating system kernel, the core part managing hardware and software. Instead of reading text files inefficiently one by one, it extracts information straight from kernel memory using optimized system calls. If you want to understand how diagnostic tools evolved, check out our guide on how to use the netstat command on Linux for network connections, exploring the legacy limitations that drove this shift.

How to list all active connections without freezing

When you simply type ss in the terminal, the system outputs a massive list of all active connections, including TCP, UDP, and local Unix sockets. Each line represents an open communication channel between your server and the outside world or internal processes. Although it looks overwhelming at first glance, this overview is excellent for getting a quick X-ray of system health and spotting anything unusual running in the background.

To make this output readable, engineers built direct filters. For instance, the -t flag displays only TCP connections, while -u focuses on UDP connections, commonly used for streaming or fast queries where occasional packet drops don't break the session. If your application is unresponsive or you suspect a blocked port that requires immediate intervention, cross-referencing these insights with ss drastically speeds up troubleshooting.

Filtering socket states and discovering port owners

One of the greatest operational advantages of ss is the ability to filter connections by their current state. A TCP socket goes through several lifecycle stages, from initial listening to session teardown. With ss, you can instruct the system to display only established connections using the state established filter, ignoring background noise and focusing strictly on active client traffic.

Besides knowing the IP address and port, administrators often need to find out which program or system user actually owns that connection. By adding the -p parameter, ss reveals the process ID (PID) and the application name tied to the socket. In the daily routine of how to use the ss command to monitor TCP connections on Linux, this granular visibility makes the difference between hours of guesswork and instant root-cause analysis.

Practical ss command examples for everyday use

To put this knowledge into action on your workstation or production server, a few handy commands save precious time. The command below lists all TCP ports currently listening for incoming connections, displaying associated programs and translating port numbers into standard service names.

ss -tulpn

If you need to investigate specific connections from a remote IP address or port, ss accepts highly flexible logical filters. The following example demonstrates how to list only established connections on the secure HTTP port:

ss -t state established '( sport = :http or dport = :https )'

Should your troubleshooting point toward physical hardware issues, cables, or routing problems rather than software layers, it is wise to combine these inspections with link diagnostic utilities, as covered in how to use mtr to find packet loss issues.

Final thoughts on network auditing with ss

Auditing network connections is no longer an afterthought; it is a foundational pillar of security and stability in modern infrastructure. The ss utility delivers the speed, precision, and flexibility that system administrators and DevOps engineers need to keep services running smoothly without surprises. By shedding old habits and mastering advanced ss filters, you gain absolute control over the data flowing in and out of your servers.

Practicing routine socket inspections prevents forgotten developer ports from turning into entry points for security breaches. Combine ss usage with automated monitoring scripts and keep your infrastructure under strict technical scrutiny.