Octet

Say this first

ss -tulpn: TCP and UDP, listening sockets, with the process, numeric (no name lookups). Run it as root, or -p cannot show processes owned by other users. ss replaced netstat -tulpn because it reads sockets through netlink instead of parsing /proc/net/tcp, so it is much faster on busy hosts. The local address column tells you whether the service listens on all addresses or only on loopback.

Go deeper

A real example

Output

$ sudo ss -tlnp
State   Recv-Q  Send-Q    Local Address:Port    Peer Address:Port  Process
LISTEN  0       4096      127.0.0.53%lo:53           0.0.0.0:*      users:(("systemd-resolve",pid=612,fd=14))
LISTEN  0       128             0.0.0.0:22           0.0.0.0:*      users:(("sshd",pid=901,fd=3))
LISTEN  0       4096          127.0.0.1:8080         0.0.0.0:*      users:(("java",pid=1532,fd=41))
LISTEN  0       511                   *:443                *:*      users:(("apache2",pid=1204,fd=6))
LISTEN  0       128                [::]:22              [::]:*      users:(("sshd",pid=901,fd=4))

127.0.0.53%lo:53 is the systemd-resolved stub, bound to loopback only.
0.0.0.0:22 accepts on every IPv4 address. [::]:22 is the IPv6 socket.
127.0.0.1:8080 is reachable only from the host itself. If clients cannot connect, this is why.
*:443 is one socket that accepts IPv4 and IPv6.
For a LISTEN socket, Recv-Q is the number of connections waiting for the application to accept them and Send-Q is the backlog size.

The letters

-t TCP, -u UDP, -l listening only, -a all states, -p process, -n numeric, -4 or -6 to pick a family, -x for Unix sockets, -s for a summary.

They will ask next

A service is listening but remote clients get connection refused. What do you check?
The bind address first: 127.0.0.1 or one specific IP means other addresses refuse. Then the host firewall (a REJECT rule also gives "refused") and whether the client really reaches this host.
The Recv-Q of a listening socket keeps growing. What does that mean?
The accept queue is filling: the application is not calling accept fast enough. When it overflows, new SYNs are dropped and nstat -az TcpExtListenOverflows climbs. That is an application or capacity problem, not a network one.

Traps

Running ss -p without root and concluding no process owns the port.
Treating 0.0.0.0 as a destination. In a listening socket it means "every local IPv4 address".

How did you do?Book 1.4 Software