Monitoring network connections with the ss command

The socket statistics command (ss) is the successor to netstat; it is not only faster, but it is also able to display more information. However, unlike netstat, which obtains its information from the various files contained within the /proc directory, the ss command obtains its information directly from the kernel space.

The basic syntax of the ss command is as follows:

# ss | less

Using this syntax, we have simply called for an output of all TCP, UDP, and Unix socket connections with an optional pipe to less in order to ensure that the results can be seen on screen. Of course, this command can be combined with either the -t, -u or, -x option to restrict any output to show either TCP, UDP, or Unix socket connections respectively, but in order to make the output more informative, you will probably want to combine one of these additional options with the -a option in order to report on both connected and listening sockets like this:

# ss -ta...