Skip to content
shellmap

ss — Inspect sockets — modern netstat replacement, faster on Linux across all 5 shells

Equivalents in every shell

Bashunix
ss -tuln

From `iproute2`. Flags: `-t` TCP, `-u` UDP, `-l` listening only, `-n` numeric (no DNS), `-p` show process holding the socket (needs root for other users' sockets). Common combos: `ss -tunlp` (everything listening, with PIDs), `ss -tn state established` (established TCP only), `ss dst :443` (filter by destination port). Way faster than `netstat` because it talks to the kernel via netlink instead of parsing `/proc/net/tcp`.

Zshunix
ss -tuln

Same `iproute2` binary. NOT on macOS — macOS still uses `netstat`. macOS-equivalent for "what is listening": `netstat -an | grep LISTEN` or `lsof -iTCP -sTCP:LISTEN -P -n`. `lsof` on macOS is the closest to `ss -tunlp` (sockets + process binding).

Fishunix
ss -tuln

Same external. Fish has decent completion for `ss` — TAB after `ss state ` lists every TCP state (`established`, `syn-sent`, `syn-recv`, `fin-wait-1`, etc). Useful idiom: `ss -tn state established | wc -l` for "how many active TCP connections do I have right now?"

PowerShellwindows
Get-NetTCPConnection

PowerShell's socket-listing cmdlet — Windows-only. `Get-NetTCPConnection -State Listen` for just listeners; `Get-NetUDPEndpoint` for UDP. Join with `Get-Process` for owning-process info: `Get-NetTCPConnection -State Listen | Select LocalPort, OwningProcess, @{n="Process";e={(Get-Process -Id $_.OwningProcess).ProcessName}}`. No `netstat`-style summary mode out of the box.

cmd.exewindows
netstat -ano

`netstat -ano` is the universal Windows answer — `-a` all sockets, `-n` numeric, `-o` show owning PID. `netstat -anob` adds the EXE name (requires admin). For listeners only: `netstat -ano | findstr LISTENING`. Windows ships `netstat` since Windows NT 3.1; the modern PowerShell `Get-NetTCPConnection` is preferred but `netstat -ano` remains the default fallback for scripts that must work everywhere.

Worked examples

List all listening TCP/UDP sockets with owning process

Bash
sudo ss -tulnp
PowerShell
Get-NetTCPConnection -State Listen | Select-Object LocalAddress, LocalPort, OwningProcess
cmd.exe
netstat -anob

Show only established TCP connections

Bash
ss -tn state established
PowerShell
Get-NetTCPConnection -State Established
cmd.exe
netstat -an | findstr ESTABLISHED

Find what is using port 8080

Bash
sudo ss -tlnp sport = :8080
PowerShell
Get-NetTCPConnection -LocalPort 8080 | Select-Object OwningProcess, @{n="Process";e={(Get-Process -Id $_.OwningProcess).ProcessName}}
cmd.exe
netstat -ano | findstr :8080

Gotchas

  • `ss` is LINUX-ONLY (`iproute2`). macOS and BSD ship `netstat` and `lsof` only — `ss` returns "command not found". For maximally portable Unix scripts use `lsof -iTCP -sTCP:LISTEN -P -n` which works on every Unix and outputs PID-bound socket info.
  • Without root, `ss -p` (or `ss -tunlp`) suppresses process info for sockets owned by OTHER users — and silently omits the column rather than erroring. If `ss -tunlp` looks unexpectedly empty in the process column, prefix with `sudo`.
  • `ss state established` filters require the WORD `state` (not just the state name). `ss established` returns no rows; `ss state established` works. Same for `ss sport = :8080` — the `= :` syntax is mandatory for the port filter form.
  • PowerShell `Get-NetTCPConnection` does NOT include UDP — UDP is `Get-NetUDPEndpoint`. Cross-protocol queries need both: `(Get-NetTCPConnection) + (Get-NetUDPEndpoint)`. The two return slightly different property names too (`LocalAddress`/`LocalPort` vs `LocalAddress`/`LocalPort` — actually identical in modern PS, but they were divergent in older builds).
  • cmd `netstat -ano | findstr :8080` matches ANY occurrence of `:8080` — including a connection FROM remote port 8080. Use `:8080 ` (with trailing space) to anchor to the local-port column, or `findstr "TCP.*:8080 "` for a tighter regex. PowerShell `Get-NetTCPConnection -LocalPort 8080` is unambiguous.

WSL & PowerShell Core notes

pwshOn Linux/macOS pwsh, neither `Get-NetTCPConnection` nor `Get-NetUDPEndpoint` is available — both are in the Windows-only `NetTCPIP` module. Use `& ss -tunlp` on Linux pwsh, `& lsof -iTCP -sTCP:LISTEN -P -n` on macOS pwsh. Pure-.NET cross-platform: `[System.Net.NetworkInformation.IPGlobalProperties]::GetIPGlobalProperties().GetActiveTcpListeners()` works on every pwsh.
WSLInside WSL `ss` lists Linux-side sockets only — Windows-host sockets are invisible. To list Windows listeners from WSL: `powershell.exe -Command "Get-NetTCPConnection -State Listen"` or `netstat.exe -ano` (the `.exe` matters from inside WSL bash). The two namespaces share IP and ports via the WSL2 NAT — a process listening on `127.0.0.1:8080` inside WSL is NOT reachable from `127.0.0.1:8080` on the Windows host (unless `localhostForwarding=true` is enabled, the default since WSL2 launch).

Common tasks using ss

Related commands