ss command: Display Linux TCP / UDP Network/Socket Information

nixCraft Articles
1

Originally published at: https://www.cyberciti.biz/tips/linux-investigate-sockets-network-connections.html


The ss command is used to show socket statistics. It can display stats for PACKET sockets, TCP sockets, UDP sockets, DCCP sockets, RAW sockets, Unix domain sockets, and more. It allows showing information similar to netstat command. It can display more TCP and state information than other tools. It is a new, incredibly useful and faster (as compare to netstat) tool for tracking TCP connections and sockets. SS can provide information about:

  • All TCP sockets.
  • All UDP sockets.
  • All established ssh / ftp / http / https connections.
  • All local processes connected to X server.
  • Filtering by state (such as connected, synchronized, SYN-RECV, SYN-SENT,TIME-WAIT), addresses and ports.
  • All the tcp sockets in state FIN-WAIT-1 and much more.
2

This topic was very useful thanks for that.

one question I have, how to enable ss -z option to see the selinux context. can anyone please help to enable this. Thanks in advance.

3

Hi @mardikiran ,

Welcome to nixCraft forum !

Try the following syntax to show all TCP sockets with process SELinux security contexts:

ss -t -a -Z
ss -p -Z

I hope this helps!