net-utils package deprecated ss and ip is the replacement commands for RHEL / CentOS / Fedora 7

The ifconfig and netstat utilities has been marked as deprecated in the man pages for CentOS 5 and 6 for nearly a decade.  Redhat made the decision to no longer install the net-utils package by default in CentOS 7. The replacement utilities are ss and ip. If you really need ifconfig and netstat back then you can yum install net-utils. Source: CentOS Wiki FAQ

Below is the Man page for the SS command

ss – another utility to investigate sockets

ss [options] [ FILTER ]

ss is used to dump socket statistics. It allows showing information similar to netstat.  It can display more TCP and state informations than other tools.

When no option is used ss displays a list of open non-listening TCP sockets that have established connection.

-h, –help
Show summary of options.

-V, –version
Output version information.

-n, –numeric
Do not try to resolve service names.

-r, –resolve
Try to resolve numeric address/ports.

-a, –all
Display both listening and non-listening (for TCP this means established connections) sockets.

-l, –listening
Display only listening sockets (these are omitted by default).

-o, –options
Show timer information.

-e, –extended
Show detailed socket information

-m, –memory
Show socket memory usage.

-p, –processes
Show process using socket.

-i, –info
Show internal TCP information.

-s, –summary
Print summary statistics. This option does not parse socket lists obtaining summary from various sources. It is useful when amount of sockets is so huge that parsing /proc/net/tcp is painful.

-b, –bpf
Show socket BPF filters (only administrators are allowed to get these information).

-4, –ipv4
Display only IP version 4 sockets (alias for -f inet).

-6, –ipv6
Display only IP version 6 sockets (alias for -f inet6).

-0, –packet
Display PACKET sockets (alias for -f link).

-t, –tcp
Display TCP sockets.

-u, –udp
Display UDP sockets.

-d, –dccp
Display DCCP sockets.

-w, –raw
Display RAW sockets.

-x, –unix
Display Unix domain sockets (alias for -f unix).

-f FAMILY, –family=FAMILY
Display sockets of type FAMILY.  Currently the following families are supported: unix, inet, inet6, link, netlink.

-A QUERY, –query=QUERY, –socket=QUERY
List  of  socket  tables  to  dump,  separated  by  commas.  The  following  identifiers  are understood: all, inet, tcp, udp, raw, unix, packet, netlink, unix_dgram, unix_stream, packet_raw,

-D FILE, –diag=FILE
Do not display anything, just dump raw information about TCP sockets to FILE after applying filters. If FILE is – stdout is used.

-F FILE, –filter=FILE
Read filter information from FILE.  Each line of FILE is interpreted like single command line option. If FILE is – stdin is used.

Please take a look at the official documentation (Debian package iproute-doc) for details regarding filters.


ss -t -a
Display all TCP sockets.

ss -u -a
Display all UDP sockets.

ss -o state established ‘( dport = :ssh or sport = :ssh )’
Display all established ssh connections.

ss -x src /tmp/.X11-unix/*
Find all local processes connected to X server.

ss -o state fin-wait-1 ‘( sport = :http or sport = :https )’ dst 193.233.7/24
List all the tcp sockets in state FIN-WAIT-1 for our apache to network 193.233.7/24 and look at their timers.

man ip , /usr/share/doc/iproute-doc-3.10.0/ (package iproute-doc)

ss was written by Alexey Kuznetosv,

This manual page was written by Michael Prokop  for the Debian project (but may be used by others).

I am a Senior System Administrator that work daily with Virtualization,Xenserver, Linux, IT automation, Ansible,Windows, Active Directory, Exchange and a lot more. Here you will find tips and trix from early junior, middle junior and senior to unique information of the topics I mentioned earlier. If you need help with something do not hesitate to contact me I will gladly help.

Tagged with: , , , , , ,