In this video, you'll learn how to analyze network sockets.
A network socket is a connection endpoint,
and it consists of an IP address followed by a port.
So 127.0.0.1 colon 80 is the network socket
that defines port 80 listening on local host.
Sockets also exist as Unix sockets,
and Unix sockets are endpoints in communication
with services on Linux or Unix.
SS is a standard tool to show socket information.
It replaces the legacy net site utility.
So SS will show all connections,
and it can be used with a couple of parameters.
And that can be handy to figure out
if anything is listening on a specific socket.
So SS-TU shows connected TCP and UDP sockets.
SS-TUA adds sockets that are in a listening state.
SS-TLN is showing TCP sockets in listening state
only without resolving host names.
And SS-DULPIN shows TCP and UDP sockets
which are in listening state, and it adds process name
or PID to the output.
Let me show you.
So here we have SS, as you can see,
lots of information.
Many of the items that are listed here are files.
Pipe it to less if you want to see what exactly it is.
So a local address can be a file,
and a port can be associated to a file as well.
That's the idea of sockets.
Sockets are not uniquely about IP addresses.
But to make it a little bit more specific, SS-TU.
For TCP and UDP sockets, well, add an A to it,
and you can see sockets that are in a listening state.
And if you add an N to it, you see port numbers
instead of port names.
Now, what I like as well is SS-TULPN,
where we get information about the sockets,
but also about the listening process.
And that's something that is often required.
If you see an illegal socket on your system,
you might want to terminate it.
And then the P information is giving the related process
and PID information,
which allows you to easily use kill on that
if you want to get rid of it.