Mastering the Linux ss Command: Complete Socket Statistics Tutorial for VPS Server Administration
Mastering the Linux ss Command: Complete Socket Statistics Tutorial for VPS Server Administration
Network troubleshooting is a critical skill for Linux administrators, DevOps engineers, and VPS users. Whether you are hosting a Django application, running Nginx, managing Docker containers, or troubleshooting database connectivity, understanding active network connections is essential.
The ss (Socket Statistics) command is a modern replacement for the older netstat utility. It provides detailed information about network sockets and is significantly faster on systems with many active connections.
In this tutorial, you'll learn how to use the ss command effectively on Linux VPS servers.
What is the ss Command?
The ss command displays information about:
- TCP connections
- UDP connections
- Listening ports
- Established connections
- Unix sockets
- Process information
- Network statistics
Most modern Linux distributions include ss by default through the iproute2 package.
Basic Syntax
ss [options]
Display all sockets:
ss
Show Listening Ports
To view services currently listening for incoming connections:
ss -l
Example output:
Netid State Recv-Q Send-Q Local Address:Port
tcp LISTEN 0 511 0.0.0.0:80
tcp LISTEN 0 128 0.0.0.0:22
This shows:
- Nginx listening on port 80
- SSH listening on port 22
Show TCP Listening Ports
ss -lt
Options:
-l= listening sockets-t= TCP sockets
Show UDP Listening Ports
ss -lu
Useful for services like DNS and DHCP.
Show Process Names
Display which process owns a socket:
ss -tulpn
Example:
tcp LISTEN 0 511 0.0.0.0:80 users:(("nginx",pid=1234))
Meaning:
- Process: nginx
- PID: 1234
- Port: 80
This is one of the most useful commands for server administration.
Find Which Service Uses Port 8000
ss -tulpn | grep :8000
Example:
tcp LISTEN 0 128 0.0.0.0:8000 users:(("gunicorn",pid=4567))
This helps identify applications occupying specific ports.
Check Active SSH Connections
ss -tn | grep :22
Example:
ESTAB 0 0 192.168.1.100:22 192.168.1.50:53422
Shows active SSH sessions connected to the server.
Display Established Connections
ss -t state established
Useful for monitoring active users and application traffic.
Monitor HTTP Connections
Check active web traffic:
ss -tn | grep :80
For HTTPS:
ss -tn | grep :443
Useful when troubleshooting Nginx or Apache servers.
Display Docker Related Connections
ss -tulpn
Look for containerized services such as:
docker-proxy
containerd
dockerd
This helps verify Docker port mappings.
Check MySQL Connections
ss -tn | grep :3306
Common for database troubleshooting.
Show Socket Summary
ss -s
Example output:
Total: 560
TCP: 120
UDP: 15
RAW: 0
Provides a quick overview of socket usage.
Compare ss and netstat
| Feature | ss | netstat |
|---|---|---|
| Faster Performance | Yes | No |
| Modern Tool | Yes | No |
| Process Information | Yes | Yes |
| Socket Statistics | Excellent | Limited |
| Default on Modern Linux | Yes | No |
For modern Linux systems, ss is generally preferred.
Practical VPS Troubleshooting Examples
Check If Nginx Is Running
ss -tulpn | grep :80
Check If HTTPS Is Working
ss -tulpn | grep :443
Check Django/Gunicorn
ss -tulpn | grep :8000
Verify MySQL
ss -tulpn | grep :3306
Verify Redis
ss -tulpn | grep :6379
Useful Command Cheat Sheet
# Show all sockets
ss
# Show listening ports
ss -l
# Show TCP listening ports
ss -lt
# Show UDP listening ports
ss -lu
# Show processes
ss -tulpn
# Show established connections
ss -t state established
# Socket summary
ss -s
# Check port 80
ss -tulpn | grep :80
# Check port 443
ss -tulpn | grep :443
# Check port 8000
ss -tulpn | grep :8000
# Check MySQL
ss -tulpn | grep :3306
Conclusion
The ss command is one of the most valuable Linux networking tools for VPS administration. Whether you're managing Nginx, Docker, Django, MySQL, Redis, or SSH services, ss provides fast and detailed insights into socket activity and network connections.
Learning to use ss effectively can significantly reduce troubleshooting time and help maintain reliable Linux server infrastructure.