In which cases I should use lsof -i and which ss?
Ss is about listening connections.
lsof-i is about all connection
I can't a comment because my reputation score is still low but the difference between the two:
lsof -i is for monitoring applications or processes that are responsible for specific connections or open ports. It can also be used for investigating malwares and unknown processes. While ss is used for real-time monitoring active connections on your network.
You could use lsof -i if your trying to find a source of a malware that somehow have gotten in your system.