Check Connections and Listening Ports with ss and netstat on Linux

This article is a localized edition of the Japanese original. Read the Japanese original

When you troubleshoot a server, you often need to know which ports are listening, which process owns each port, and where connections are coming from and how many there are. On Linux, the commands for this are ss (socket statistics) and the older netstat.

On current major distributions, the iproute2 package that contains ss is standard, while the net-tools package that contains netstat may be missing from minimal installs. This article focuses on ss and covers the checks you will use most. The commands and output were verified as of October 2026 on Debian 12 (iproute2 6.1.0).

Installing ss and netstat

If ss is not found, install iproute2. If you want netstat, install net-tools.

# Debian / Ubuntu
sudo apt install iproute2      # ss
sudo apt install net-tools     # netstat

# RHEL / AlmaLinux / Rocky Linux
sudo dnf install iproute       # ss
sudo dnf install net-tools     # netstat

Common options

Check listening ports and their processes

The command you will use most is ss -tulnp. It shows the TCP and UDP ports that are listening, together with the processes using them.

sudo ss -tulnp

Sample output:

Netid State  Recv-Q Send-Q Local Address:Port Peer Address:PortProcess
udp   UNCONN 0      0            0.0.0.0:5353      0.0.0.0:*    users:(("nc",pid=365,fd=3))
tcp   LISTEN 0      1            0.0.0.0:8443      0.0.0.0:*    users:(("nc",pid=364,fd=3))
tcp   LISTEN 1      1            0.0.0.0:8080      0.0.0.0:*    users:(("nc",pid=363,fd=3))

• Local Address:Port is the address and port being listened on. 0.0.0.0 means all IPv4 addresses, and 127.0.0.1 means only connections from the machine itself are accepted. For IPv6 you will see [::] or *
• In the Process column, users:(("process_name",pid=N,fd=N)) is the process using that port
• To see processes owned by other users with -p, you need root privileges. Without sudo, the Process column is empty for processes that are not yours

To look at a specific port only, specify the port in a filter.

# Process listening on port 443
sudo ss -tlnp 'sport = :443'

# Filter by process name (example: nginx)
sudo ss -tlnp | grep nginx

You can also use lsof.

sudo lsof -nP -iTCP -sTCP:LISTEN

Check established connections

With the state filter, you can show connections in a specific state.

ss -tn state established

Sample output:

Recv-Q Send-Q Local Address:Port  Peer Address:Port Process
0      0          127.0.0.1:60984    127.0.0.1:8080
0      0          127.0.0.1:8080     127.0.0.1:60984

When you specify state, the State column disappears and every column shifts one position to the left. The remote end (Peer Address:Port) is in column 4.

To see only connections arriving at a specific port on your server (for example 443), filter by sport (the local port). To see connections from your server to a specific port on another host, use dport (the remote port).

# Connections coming in to port 443 on this server
ss -tn state established '( sport = :443 )'

# Connections going out to port 3306 (MySQL) on other hosts
ss -tn state established '( dport = :3306 )'

# Filter by a port range
ss -tn 'dport >= :8000 and dport <= :9000'

Count connections per client IP

When traffic spikes, count which IP addresses have the most connections. -H removes the header, and the port number is stripped from column 4 (the remote end) before counting.

ss -Htn state established '( sport = :443 )' \
  | awk '{print $4}' | sed -E 's/:[0-9]+$//' \
  | sort | uniq -c | sort -rn | head

The output is in the form "count IP address", sorted from most to fewest. IPv6 addresses are shown in brackets, like [2001:db8::1]. Because sed removes only the final :port, IPv6 addresses are not cut off in the middle.

Count connections by state

ss -Htan | awk '{print $1}' | sort | uniq -c

Sample output:

      4 ESTAB
      2 LISTEN
      2 TIME-WAIT

ss shows state names such as ESTAB and TIME-WAIT (netstat shows ESTABLISHED and TIME_WAIT).

If you only need overall totals, ss -s is the quickest.

ss -s

Total: 13
TCP:   46 (estab 4, closed 40, orphaned 0, timewait 2)

Check the number of TIME-WAIT sockets

TIME-WAIT is a state that remains for a while on the side that closed the connection first. On servers that handle many short connections, such as web servers and reverse proxies, having some of them is normal. To get just the count, drop the header and count the lines.

ss -Htan state time-wait | wc -l

Without -H, the header line is counted too, so keep that in mind.

netstat equivalents

If an older runbook uses netstat, translate the commands as follows.

netstat -tulnp and ss -tulnp use options with the same meaning and show almost the same information. Without -l or -a, however, they differ: netstat -tn shows all non-listening connections including TIME_WAIT, while ss -tn does not show TIME-WAIT. The column order and state names also differ, so scripts that pick out columns with awk and similar tools cannot be reused as is.

Things to watch out for

• Without -n, the command tries to resolve IP addresses and ports to names, which can make the output slow. Use -n as a rule when investigating
• Showing processes with -p requires sudo
• Connections of processes running inside a container may only be visible inside the container's network. With Docker, check from inside the container, or check the published ports with ss on the host
• Once you know which ports are listening, close the ones that do not need to be public with your firewall, or change their configuration so they listen only on 127.0.0.1

Summary

• Check listening ports and processes with sudo ss -tulnp
• Show established connections with ss -tn state established. When you specify state, the State column disappears and the remote end is in column 4
• When counting, remove the header with -H, then count with awk, sort and uniq -c
• Get overall totals with ss -s
• netstat works once the net-tools package is installed, but use ss and ip for new procedures

Related articles:

• How to open a port in the firewall
• TCP/IP basics
• Monitoring the network with netstat and ss

Questions about WordPress? The publisher of this site is based in Japan and replies in Japanese. Contact (Japanese)