Networking & Firewall (Ss/Netstat/Iptables/Nftables/Curl)

Identifying Local Socket Owners with SS

🧩 The Challenge

You have identified an unknown process listening on a specific port but need to find the exact binary or user responsible without scouring long logs.

💡 The Fix

Use the socket statistics utility with process information flags to map the listening port directly to a specific process ID and owner.

sudo ss -lptn 'sport = :80'

⚙️ Why It Works

The -l flag filters for listening sockets, -p shows the process using the socket, and -t ensures we are only looking at TCP connections while the filter narrows the scope to port 80.

🚀 Pro-Tip: Append -u to the command if you need to perform the same diagnostic on UDP sockets.

Linux Tips & Tricks | © ngelinux.com | 7/8/2026