How To Use Linux SS Command?

Introduction

Linux operating system works on both CLI i.e. command line interface, and GUI, i.e., graphical user interface. So, a “Linux command” refers to any instruction or action issued to the Linux operating system through the command-line interface. These commands are used to perform a wide range of tasks, including managing files and directories, manipulating system configurations, executing programs, monitoring system resources, and more. Linux ss commands typically follow a specific syntax and are executed by typing them into the terminal and pressing Enter. 

The “ss” command in Linux, short for “socket statistics,” is an adaptable tool designed to monitor network connections and socket information. It serves as a replacement for the deprecated netstat command and offers a wide range of functionalities. Using ss, users can view socket statistics, monitor network connections in real-time, filter socket information based on various criteria such as state, protocol, and port, and access advanced options for detailed socket analysis. Through this article, we will witness its flexibility and robust features, which make it invaluable for network troubleshooting, monitoring, and management tasks.

Basic Syntax of `ss` Command in Linux

Take a look at the basic syntax of ss command in Linux.

ss [options]

Certainly! Think of the [options] as settings or choices you can add to the ss command to tell it exactly what you want to see or do. These options are like switches that you can turn on or off to customize how the command behaves. They help you to filter and refine the information that ss provides.

For instance:

• If you want to see only TCP sockets, you would use the -t option.
• If you want to see both listening and non-listening sockets, you would use the -a option.
• If you want to see UDP sockets instead of TCP, you would use the -u option.
• If you want to see which process is using each socket, you would use the -p option.

By combining different options, you can tailor the output of the ss command to meet your specific needs. These options give you control over what kind of socket information you want to see and how you want it to be displayed.

Options Available in the `ss` Command Linux

The ss command in Linux is used to display socket statistics. Here are some of the commonly used options with the ss command:

1. -t: Display TCP socket information.
2. -u: Display UDP socket information.
3. -l: Show only listening sockets.
4. -a: Display all sockets (listening and non-listening).
5. -p: Show process using the socket.
6. -n: Show numerical addresses instead of resolving hostnames.
7. -r: Display routing information.
8. -s: Show summary statistics.
9. -4: Display only IPv4 sockets.
10. -6: Display only IPv6 sockets.
11. -H: Display header lines.
12. -h: Display help message with usage options.

You can use these options in combination to filter and display the desired socket information. For example, ss -t -l will display only listening TCP sockets, while ss -u -a -p will show all UDP sockets along with the process using them.

Displaying Socket Information

Displaying socket information with the ss command provides insights into the network connections established on a Linux system. Each line of output typically represents a single socket. Here’s a breakdown of the common elements found in the socket information displayed by the ss command.

Socket information displayed by the ss command provides crucial insights into network connections on a Linux system. It includes details such as the current state of the socket, like whether it’s LISTENing for incoming connections (for TCP sockets) or if it’s UNCONNected (for UDP sockets). Additionally, it shows the amount of data waiting to be sent or received over the socket, which can indicate system processing bottlenecks. The Local Address field reveals the socket’s address and port number, while the Peer Address (for TCP) indicates the remote peer’s details. The State of the Connection provides more nuanced information, especially for TCP connections. Moreover, the UID and PID/Program Name fields help identify the user or process associated with each socket, aiding in network monitoring and troubleshooting efforts.

Linux ss Command Examples

Here are examples of using the ss command in various scenarios:

List All Connections:

ss -a 

List Listening Sockets:

ss -l 

List TCP Connections:

ss -t 

List UDP Connections:

ss -u 

List Unix Sockets:

ss -x 

List Raw Sockets:

ss -w 

List Connections to a Specific IP Address:

ss dst <IP_Address> 

Check Process IDs:

ss -p 

List Summary Statistics:

ss -s 

List IPv4 and IPv6 Socket Connections:

ss -4 ss -6 

Filter Connections:

ss state <State> 

Check Man Pages or List All Commands:

man ss

netstat VS ss Command

Netstat is a command-line network utility tool available in Unix, Unix-like, and Windows operating systems. It’s used to display network connections, routing tables, interface statistics, masquerade connections, and multicast memberships. It provides a wide range of information related to network connections and network interfaces. Netstat provides administrators with valuable information about network connections and interfaces on their systems. However, it has been deprecated in many Linux distributions in favor of newer tools like ss and ip, which offer more features and better performance. 

Displaying Network Connections: 

netstat can show all active network connections, including TCP, UDP, and Unix domain sockets. This includes both listening and non-listening sockets.

Displaying Routing Table: 

It can display the kernel routing table, which shows information about the routes packets will take to reach their destination.

Also Read: 50+ Linux Commands with Screenshots

Conclusion 

The ss command in Linux serves as a versatile tool for monitoring network connections and socket information. Its flexible options allow users to tailor the output according to their specific needs, whether it’s viewing TCP or UDP sockets, identifying listening sockets, or listing connections to a specific IP address. By combining different options, users gain precise control over the displayed socket information, making it invaluable for network troubleshooting, monitoring, and management tasks.

Compared to its predecessor, netstat, ss offers improved performance and additional features, making it the preferred choice for many Linux distributions. While netstat provides valuable information about network connections and interfaces, ss offers more detailed socket analysis and better performance.