Linux Ss Command Show Port Number

Decoding the Mystery: Using the ss Command to Show Port Numbers in Linux

The ss command is a powerful networking tool in Linux, offering a more efficient and modern alternative to the older netstat command. One of its most useful functions is displaying active network connections, including crucial information like the port numbers involved. This article will guide you through effectively using ss to identify specific port numbers, understand the output, and troubleshoot network issues. Learn how to filter results for precise port information and effectively diagnose network problems.

Understanding the ss command's output is key to leveraging its power. It provides a wealth of data, including the state of the connection (ESTABLISHED, LISTEN, etc.), the local and remote addresses and ports, and the process ID (PID) associated with each connection. This granular detail helps pinpoint problems and optimize network configurations.

Basic Syntax and Common Options

The fundamental syntax for using ss to display port information is straightforward:

ss -t -a -p

Let's break down these options:

• -t: Specifies that we want to see TCP connections. Omit this for UDP connections (use -u instead).
• -a: Displays all connections, including those in various states (LISTEN, ESTABLISHED, etc.).
• -p: Shows the process ID (PID) and program name associated with each connection. This is incredibly helpful for identifying which application is using a specific port.

This simple command will list all active TCP connections, showing their local and remote addresses, including port numbers, along with the PID of the associated process.

Filtering for Specific Port Numbers

To pinpoint connections using a particular port, you can employ the -p option combined with the grep command. For example, to find all connections using port 80 (HTTP):

ss -t -a -p | grep ':80'

This command will filter the output of ss to only show lines containing ':80', effectively isolating connections using port 80. Remember to replace ':80' with the desired port number.

Identifying Processes Using Specific Ports

The -p option is crucial for understanding which process is using a given port. This information is essential for troubleshooting conflicts and managing network services. For instance, to see the process using port 22 (SSH):

ss -t -a -p | grep ':22'

The output will include the PID, allowing you to use commands like ps aux | grep <PID> to identify the specific process.

Understanding Different Connection States

The ss command displays the state of each connection, providing further insights into network activity. Common states include:

• ESTABLISHED: A fully established connection between two endpoints.
• LISTEN: A server is waiting for incoming connections on a specific port.
• SYN_SENT: The client has initiated a connection and is awaiting a response.
• SYN_RECV: The server has received a connection request and is awaiting confirmation.
• TIME_WAIT: A connection is closing gracefully.

Observing these states can be valuable in diagnosing network issues.

Advanced Filtering Techniques

For more complex filtering, you can combine multiple options and use more sophisticated grep patterns. For example, to find all ESTABLISHED TCP connections on port 443 (HTTPS):

ss -t state established -a -p | grep ':443'

This showcases the flexibility of ss for precise network monitoring and diagnostics. Experiment with different options and filters to master its capabilities.

Conclusion

The ss command provides a powerful and versatile means to investigate network connections and identify port usage in Linux. Mastering its options and filtering techniques allows for efficient troubleshooting and a deeper understanding of your system's network activity. By combining ss with other command-line tools like grep and ps, you gain a comprehensive toolkit for managing and monitoring your network effectively. Remember to consult the man ss page for a complete reference on all available options and their functionalities.