A short guide to ss output

2026-05-22/net/4 min

ss replaced netstat years ago. It is faster and denser, and rather less explained.

$ ss -ltnp
State  Recv-Q Send-Q Local Address:Port  Peer Address:Port
LISTEN 0      511          0.0.0.0:80         0.0.0.0:*

The queue columns change meaning

This trips up everyone once. On a LISTEN socket, Recv-Q is the number of completed connections waiting to be accepted and Send-Q is the configured backlog maximum. A non-zero Recv-Q on a listener means the application is not calling accept() fast enough — it is a load signal, not a byte count.

On an ESTAB socket the same two columns are unread and unacknowledged bytes. Same header, unrelated meaning.

Reading the addresses

0.0.0.0:80 is every IPv4 interface. 127.0.0.1:8443 is loopback only — unreachable from another host regardless of what the firewall says. *:443 means both address families at once.

Worth keeping

ss -s                      # summary counts by state
ss -tn state established
ss -ltnp | grep -v 127.0.0.1   # what is actually exposed

That last one is the single most useful line here. Firewall rules describe intent; this describes what is really listening.