Old news

In the simplest form ss is equivalent to netstat with some small deviations.

• ss -t -a dumps all TCP sockets
• ss -u -a dumps all UDP sockets
• ss -w -a dumps all RAW sockets
• ss -x -a dumps all UNIX sockets

Option -o shows TCP timers state. Option -e shows some extended information. Etc. etc. etc. Seems, all the options of netstat related to sockets are supported. Though not AX.25 and other bizarres. :-) If someone wants, he can make support for decnet and ipx. Some rudimentary support for them is already present in iproute2 libutils, and I will be glad to see these new members.

However, standard functionality is a bit different:

The first: without option -a sockets in states TIME-WAIT and SYN-RECV are skipped too. It is more reasonable default, I think.

The second: format of UNIX sockets is different. It coincides with tcp/udp. Though standard kernel still does not allow to see write/read queues and peer address of connected UNIX sockets, the patch doing this exists.

The third: default is to dump only TCP sockets, rather than all of the types.

The next: by default it does not resolve numeric host addresses (like ip)! Resolving is enabled with option -r. Service names, usually stored in local files, are resolved by default. Also, if service database does not contain references to a port, ss queries system rpcbind. RPC services are prefixed with rpc. Resolution of services may be suppressed with option -n.

It does not accept "long" options (I dislike them, sorry). So, address family is given with family identifier following option -f to be algined to iproute2 conventions. Mostly, it is to allow option parser to parse addresses correctly, but as side effect it really limits dumping to sockets supporting only given family. Option -A followed by list of socket tables to dump is also supported. Logically, id of socket table is different of _address_ family, which is another point of incompatibility. So, id is one of all, tcp, udp, raw, inet, unix, packet, netlink. See? Well, inet is just abbreviation for tcp$\vert$udp$\vert$raw and it is not difficult to guess that packet allows to look at packet sockets. Actually, there are also some other abbreviations, f.e. unix_dgram selects only datagram UNIX sockets.

The next: well, I still do not know. :-)