ss
what is listening heress reads socket state straight from the kernel: every listening port and every open connection, with the process behind it. It replaced netstat and answers the two questions that come up constantly — is the service actually listening, and on which address.
A service that listens on 127.0.0.1 and one that listens on 0.0.0.0 look identical from the inside — and completely different from the network.
At the terminal
Read the session first, then the notes: each numbered line in the output is answered by the note with the same number.
What the numbered lines are telling you
127.0.0.53%lo is the DNS stub, tied to the loopback device. Nothing off the machine can reach it.
sshd accepts connections on whichever address the host has, on every interface. This is what "exposed" looks like.
The node process on 8080 is reachable from this machine and nowhere else. The usual reason a service "works locally but not remotely".
A separate socket for the same daemon. A firewall that only filters IPv4 leaves this one open.
Switches
A switch changes how the command behaves. These are the ones used day to day; man ss lists the rest. Single-letter switches can usually be joined, so -l -a may be written -la.
-t- TCP sockets only.
-u- UDP sockets only.
-l- Listening sockets only — what is waiting for connections.
-n- Numeric: show port numbers and addresses, do not look up names.
-p- Show the process that owns each socket. Needs root to see other users’.
-a- All: both listening and connected sockets.
-s- Summary: counts of sockets by type.
-4- IPv4 only. -6 is IPv6 only.
Variations worth knowing
The same tool, pointed at a narrower question. These four cover most of what it is reached for day to day.
ss -tunlpAdds UDP to the listing — DNS, DHCP and NTP listeners do not appear with -t alone.
ss -tn state establishedOnly the connections that are open right now, with both ends' addresses and ports.
ss -tn dst 192.0.2.10Filters by peer: every connection this host has to one address.
ss -tiPer-connection TCP internals — congestion window, round-trip time and retransmits.
In cybersecurity
Every listening socket is a door, and ss is the list of doors. Reading it is the cheapest security review a host can get.
Anything on 0.0.0.0 or [::] is exposed on every interface. Databases and admin panels should rarely appear that way.
A high port owned by an unfamiliar process is how a backdoor looks. Follow the pid to its binary.
What ss lists and what nmap finds from outside should agree. A port open here and closed there is a firewall; the reverse is a concern.
Established connections to unexpected addresses are how command-and-control and exfiltration show up.
ss asks the kernel. If the kernel is compromised the answer is too — which is why an external scan is the cross-check.
Daemons often bind both families. Audit the [::] lines with the same care as the IPv4 ones.