ss

Socket Statistics. Shows information similar to netstat , ss can display more TCP and state information than other tools.

Syntax:
 ss [options] [FILTER]
Options
 -n, --numeric Do now try to resolve service names.
 -r, --resolve Try to resolve numeric address/ports.
 -a, --all Display all sockets.
 -l, --listening Display listening sockets.
 -o, --options Show timer information.
 -e, --extended Show detailed socket information
 -m, --memory Show socket memory usage.
 -p, --processes Show process using socket.
 -i, --info Show internal TCP information.
 -s, --summary Print summary statistics.This option does not parse socket lists
 obtaining summary from various sources. It is useful when amount
 of sockets is so huge that parsing /proc/net/tcp is painful.
 -A QUERY,
 --query=QUERY,
 --socket=QUERY List of socket tables to dump, separated by commas.
 The following identifiers are understood: all, inet, tcp, udp, raw,
 unix, packet, netlink, unix_dgram, unix_stream, packet_raw, packet_dgram.
 -D FILE, --diag=FILE
  Do not display anything, just dump raw information about
 TCP sockets to FILE after applying filters. If FILE is - stdout is used.
 -f FAMILY, --family=FAMILY
 Display sockets of type FAMILY.
 Currently the following families are supported: unix, inet, inet6, link, netlink.
 -F FILE,
 --filter=FILE Read filter information from FILE. Each line of FILE is
 interpreted like single command line option. If FILE is - stdin is used.
 FILTER := [ state TCP-STATE ] [ EXPRESSION ]
 -4, --ipv4 Display only IP version 4 sockets (alias for -f inet).
 -6, --ipv6 Display only IP version 6 sockets (alias for -f inet6).
 -0, --packet Display PACKET sockets.
 -t, --tcp Display only TCP sockets.
 -u, --udp Display only UDP sockets.
 -d, --dccp Display only DCCP sockets.
 -w, --raw Display only RAW sockets.
 -x, --unix Display only Unix domain sockets.
 -h, --help Show summary of options.
 -V, --version Output version information.

Look at the official docs (Debian package iproute-doc) for details regarding filters.

Examples

Display all TCP sockets. ss -u -a Display all UDP sockets:

ss -t -a

List all applications connecting to the internet:

ss -p

Display all established ssh connections:

ss -o state established '( dport = :ssh or sport = :ssh )'

Find all local processes connected to X server:

ss -x src /tmp/.X11-unix/*

List all the tcp sockets in state FIN-WAIT-1 for our apache to network 193.233.7/24 and look at their timers:

ss -o state fin-wait-1 '( sport = :http or sport = :https )' dst 193.233.7/24

"If your experiment needs statistics, you ought to have done a better experiment" ~ Ernest Rutherford

Related Linux commands

ip - Routing, devices and tunnels.
nc - Netcat, read and write data across networks.
netstat - Networking connections/stats.