← All cheat sheets

SS COMMAND

Plain-text reference · 4 KB. Read it, search it (Ctrl-F) or print it.

ss (socket statistics) is the modern replacement for netstat on Linux,
from the iproute2 package. Faster and more detailed for live host triage:
what is listening, who is connected, and which process owns a socket.

MOST-USED INVOCATION#

ss -tulpn
  -t  TCP sockets
  -u  UDP sockets
  -l  listening sockets only
  -p  show owning process (PID/program) -- needs root for other users' procs
  -n  numeric (no DNS/port-name resolution; faster, avoids lookups)

So: ss -tulpn = "all TCP+UDP listeners, numeric, with process" -- the single
most useful command for "what is this box exposing?".

CORE FLAGS#

-t   TCP
-u   UDP
-x   UNIX domain sockets
-w   raw sockets
-a   all sockets (listening AND non-listening)
-l   listening only
-n   numeric addresses/ports (no resolution)
-p   process using the socket
-r   resolve names (opposite of -n)
-e   extended info (uid, inode, etc.)
-o   timer information (retransmit/keepalive timers)
-m   socket memory usage
-i   internal TCP info (cwnd, rtt -- latency/throughput triage)
-s   summary statistics (counts by protocol/state)
-4 / -6   IPv4 only / IPv6 only

COMMON TRIAGE COMMANDS#

ss -tlpn                 TCP listeners + process (what's exposed)
ss -ulpn                 UDP listeners + process
ss -tanp                 all TCP sockets, numeric, with process
ss -tap                  all TCP with process (resolve names)
ss -s                    summary counts (total, estab, closed, by proto)
ss -tnp state established     active established TCP connections
ss -o state established '( dport = :443 or sport = :443 )'   with timers

STATE FILTERS (TCP)#

ss -t state established
ss -t state listening
ss -t state syn-sent
ss -t state syn-recv
ss -t state time-wait
ss -t state close-wait
ss -t state fin-wait-1
Shortcuts:
ss -t state connected    any state except listen/closed (all active conns)
ss -t state bucket       time-wait + syn-recv (kernel "mini-sockets")
ss -t state big          all except the small/bucket states

ADDRESS & PORT FILTERS#

ss -tn dst 10.0.0.5                 connections to a destination IP
ss -tn dst 10.0.0.0/24              to a subnet
ss -tn src 192.168.1.10            from a source IP
ss -tn dport = :443                 destination port 443
ss -tn sport = :22                  source port 22 (your SSH listeners/conns)
ss -tn '( dport = :80 or dport = :443 )'   web traffic
ss -tn dport \> :1024               destination port above 1024
ss -tn dst 10.0.0.5 and dport = :3389      combine conditions
(Quote expressions with ( ) and operators; escape > < as \> \< in the shell.)

FILTER BY PROCESS#

ss -tlpn | grep sshd                 listeners for a process (quick)
ss -tnp '( sport = :22 )'            SSH sockets with process info
# Newer ss supports: ss -tp sport = :443 (see man for cgroup/process match)

SOC TRIAGE PATTERNS#

# 1. Inventory everything the host listens on + owning process
ss -tulpn

# 2. Spot a suspicious listener (e.g. an unexpected high port with no name)
ss -tlpn | sort -t: -k2 -n

# 3. Current outbound connections to the internet (exclude RFC1918 roughly)
ss -tnp state established | grep -vE '10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.'

# 4. Who is connected to our RDP/SSH right now
ss -tnp state established '( sport = :3389 )'
ss -tnp state established '( sport = :22 )'

# 5. Connection-state summary (lots of SYN-RECV = possible SYN flood)
ss -s

# 6. Count established connections per remote IP (beacon/scan triage)
ss -tn state established | awk '{print $5}' | cut -d: -f1 |
  sort | uniq -c | sort -rn | head

MAPPING FROM netstat#

netstat -tulpn      ->  ss -tulpn
netstat -ant        ->  ss -ant
netstat -s          ->  ss -s
netstat -tnp        ->  ss -tnp
ss is preferred: faster, reads /proc/net via netlink, and filters natively.

NOTES#

- Seeing the PID/program for other users' sockets requires root (sudo).
- -n avoids ss making DNS/port lookups -- important during IR to prevent the
  triage tool itself from generating network noise.
- Pair ss with `lsof -i`, `/proc/<pid>/exe`, and ps to confirm the binary
  behind a suspicious socket.

Defensive reference on CyberRamen. Offensive / red-team sheets live on OffensiveRamen.com.