ss

Socket Statistics.
Shows information similar to the now deprecated netstat, ss can display more TCP and state information than other tools.

Syntax

     ss [options] [FILTER]

Options

   -n, --numeric    Do not try to resolve service names.
   -r, --resolve    Try to resolve numeric address/ports.
   -a, --all        Display all sockets.
   -l, --listening  Display listening sockets.
   -o, --options    Show timer information.
   -e, --extended   Show detailed socket information
   -m, --memory     Show socket memory usage.
   -p, --processes  Show process using socket.
   -i, --info       Show internal TCP information.
   -s, --summary    Print summary statistics.This option does not parse socket lists
                    obtaining summary from various sources. It is useful when amount
                    of sockets is so huge that parsing /proc/net/tcp is painful.

   -A QUERY,
   --query=QUERY,
   --socket=QUERY   List of socket tables to dump, separated by commas.
                    The following identifiers are understood: all, inet, tcp, udp, raw,
                    unix, packet, netlink, unix_dgram, unix_stream, packet_raw, packet_dgram.

   -D FILE, --diag=FILE
                    Do not display anything, just dump raw information about
                    TCP sockets to FILE after applying filters. If FILE is - STDOUT is used.

   -f FAMILY, --family=FAMILY
                    Display sockets of type FAMILY.
                    Currently the following families are supported: unix, inet, inet6, link, netlink.

   -F FILE,
   --filter=FILE    Read filter information from FILE. Each line of FILE is
                    interpreted like single command line option. If FILE is - STDIN is used.
                    FILTER := [ state TCP-STATE ] [ EXPRESSION ]

   -4, --ipv4       Display only IP version 4 sockets (alias for -f inet).
   -6, --ipv6       Display only IP version 6 sockets (alias for -f inet6).
   -0, --packet     Display PACKET sockets.
   -t, --tcp        Display only TCP sockets.
   -u, --udp        Display only UDP sockets.
   -d, --dccp       Display only DCCP sockets.
   -w, --raw        Display only RAW sockets.
   -x, --unix       Display only Unix domain sockets.

   -h, --help       Show summary of options.
   -V, --version    Output version information.

Look at the official docs (Debian package iproute-doc) for details regarding filters.

Examples

Display all TCP sockets. ss -u -a Display all UDP sockets:

ss -t -a

List all applications connecting to the internet:

ss -p

Display all established ssh connections:

ss -o state established '( dport = :ssh or sport = :ssh )'

Find all local processes connected to X server:

ss -x src /tmp/.X11-unix/*

List all the tcp sockets in state FIN-WAIT-1 for our apache to network 193.233.7/24 and look at their timers:

ss -o state fin-wait-1 '( sport = :http or sport = :https )' dst 193.233.7/24

“If your experiment needs statistics, you ought to have done a better experiment” ~ Ernest Rutherford

Related Linux commands

ip - Routing, devices and tunnels.
nc - Netcat, read and write data across networks.