Networking & Firewall (Ss/Netstat/Iptables/Nftables/Curl)

Stop guessing which process is hogging your ephemeral ports

🧩 The Challenge

Dealing with a production app that randomly drops connections because it ran out of sockets is a nightmare. You end up staring at thousands of lines of output just trying to figure out which specific PID is eating the port range alive.

💡 The Fix

Use a specific ss flag to filter by state and show the process owner directly in the output. It saves you from having to cross-reference PIDs manually and lets you spot the offender in seconds.

ss -tulpn | grep LISTEN
ss -ntaup

⚙️ Why It Works

Adding the -p flag forces the kernel to look up the process associated with the socket, which is the only way to avoid the headache of mapping ports back to PIDs by hand. That extra bit of metadata is a lifesaver when the server load is climbing and you need an answer yesterday.

🚀 Pro-Tip: Pipe it into sort to see which services are opening the most connections if you suspect a leak.

Linux Tips & Tricks | © ngelinux.com | 9/4/2026