Networking & Firewall (Ss/Netstat/Iptables/Nftables/Curl)

Stop ss from hiding the process owner when you are debugging weird connections

🧩 The Challenge

There is nothing more annoying than seeing a mysterious process binding to a high port and having no clue which user or binary actually opened the socket. You run netstat or ss, see the connection, but the “who” column is just empty or a question mark because you forgot your privileges.

💡 The Fix

You need to run the socket stats command with root permissions to force the kernel to dump the process information, which finally reveals the actual PID and the user associated with that socket.

sudo ss -tpn

⚙️ Why It Works

Adding the -p flag forces the tool to dig into the process table for every active socket, but it requires elevation because standard users don’t have the kernel’s permission to inspect process file descriptors owned by others. Without the sudo, you are basically flying blind and hoping the kernel shares its secrets.

🚀 Pro-Tip: Pipe that into grep if you are hunting a specific port so you don’t have to scroll through a thousand lines of local traffic.

Linux Tips & Tricks | © ngelinux.com | 8/2/2026