ss

Investigate socket statistics — the modern, faster replacement for netstat.

low risk

interactive breakdown — edit the command and press Explain
$ 
What it does

ss queries the kernel directly for socket information — faster and more accurate than netstat. -tulnp is the canonical combination: TCP, UDP, Listening, Numeric, with Process info. Use to verify which services listen on which ports.

Common flags
FlagMeaning
-t --tcpShow TCP sockets
-u --udpShow UDP sockets
-l --listeningShow only listening sockets
-n --numericDon't resolve service names or hostnames
-p --processesShow the process using each socket
-4Show only IPv4 sockets
-6Show only IPv6 sockets
Examples
ss -tulnpShow all listening TCP/UDP ports with process names — standard network debug command · explain & risk-check →
ss -tnp state establishedShow established TCP connections with processes · explain & risk-check →
ss -tulnp | grep :443Check which process is listening on HTTPS port 443 · explain & risk-check →
Pro tip

Use `ss -s` for a quick socket count summary by state — great for spotting connection storms or TIME_WAIT buildup.

Related
netstat lsof nmap curl nc
Open the full explainer →More in Networking

Reference text is hand-written and may be incomplete — check man ss for your version. Test destructive commands on a non-production system first.