How it works...

ss is a quick way of determining the sockets that a system is currently using, and it's not limited to TCP or UDP, as it's also able to display Unix domain sockets (-x).

In this example, we've queried the system to find out which ports are in use, and ss has performed some resolution work to determine what services those ports are likely to be used by.

This is not a guarantee, however. For example, if you start a Python web server on 2222, it would list the following:

$ ss -l sport = :2222
Netid  State      Recv-Q Send-Q                                      Local Address:Port                                                       Peer Address:Port                
tcp    LISTEN     0      5                                                       *:EtherNet/IP-1                                                         *:*     

This is simply because as far as /etc/services is concerned, this port is used by EtherNet/IP-1:

$ grep "^EtherNet" /etc/services
EtherNet/IP-1   2222/tcp  EtherNet-IP-1 # EtherNet/IP I/O
EtherNet/IP-1   2222/udp  EtherNet-IP-1 # EtherNet/IP I/O
EtherNet/IP-2   44818/tcp EtherNet-IP-2  # EtherNet/IP messaging
EtherNet/IP-2   44818/udp EtherNet-IP-2  # EtherNet/IP messaging