---
title: ss — Check sockets and ports
date: 2026-10-18
time: 12:00
model: admin
category: programs
author_type: human
summary: A netstat replacement command that shows ports in LISTEN state and connection status. Essential for diagnosing port conflicts.
tags: program, Network and Firewall, ss
---

**💬 "ss command"**

ss quickly shows **open ports and connection state**. It replaces netstat.

Use it to check whether a service is holding a port and who is holding it.

- **Concept**: Queries the state and addresses of TCP/UDP sockets.
- **LISTEN**: A server socket waiting for connections.
- **Local address**: 0.0.0.0:80 means all interfaces, and 127.0.0.1:80 means local only.
- **Process**: Use -p to show the process holding the port.
## Commonly used options

| Option | Description |
| --- | --- |
| -l | Show only LISTEN sockets |
| -t / -u | Show only TCP / UDP |
| -n | Show numeric values without name resolution (fast) |
| -p | Show the process using the socket |

## 3 essential command combinations

- `ss -lntp` — Check TCP LISTEN ports and processes
- `ss -lntp | grep ':80'` — Check which process is holding port 80
- `ss -s` — Socket state summary statistics
**💬 "Tell me a useful way to use this when digging through logs"**

Here are common situations on live servers, organized in order.

### Step 1 · Check LISTEN

Check whether the service is listening on the expected port.

```
ss -lntp
```

### Step 2 · Check a specific port

Check for conflicts.

```
ss -lntp | grep -E ':(80|443|8080)\b'
```

### Step 3 · Check connection state

Check the distribution of states such as TIME_WAIT.

```
ss -s
```

## In practice, use it like this

### 1. Port conflict

**Situation** — A new service fails to bind to 8080.

```
ss -lntp | grep ':8080'
```

**Result** — If another process is already holding it, its PID and name are shown.

**Point** — Identify the conflicting process and stop it or change the port.

### 2. Diagnosing blocked external access

**Situation** — The firewall is open but connections still fail.

```
ss -lntp | grep ':443'
```

**Result** — If it is only listening on 127.0.0.1:443, external clients cannot connect.

**Point** — Always check the bind address (0.0.0.0 vs 127.0.0.1).

## Things to keep in mind

- -p may require sudo because it needs privileges to view other users' socket information.
- Name resolution (without -n) can cause DNS delays, so -n is recommended.
- Checking only LISTEN status does not guarantee that traffic passes through the firewall.
## Actual execution output

This is the output after checking LISTEN ports and processes.

![ss command output: LISTEN ports and processes](https://games.aidebatehub.com/assets/ss-demo.png)

Live production server

---
Source (HTML): https://games.aidebatehub.com/programs/linux/network/ss.html
This file is an auto-generated Markdown twin of the DevHub document.