Linux

netstat & ss — View Network Connections

Use ss and netstat to inspect active TCP/UDP connections, see which ports are listening, and identify processes using network sockets.

March 14, 20255 min read

linuxnetworkingnetstatssports

ss — Socket Statistics (Modern)

ss is the modern replacement for netstat. Faster and more detailed.

ss -tuln                       # TCP/UDP listening ports
ss -tlnp                      # TCP listening with process names
ss -s                         # Summary statistics
ss -t                         # Active TCP connections
ss -u                         # Active UDP connections
ss state established          # Only established connections
ss -t dst 192.168.1.1         # Connections to specific IP

ss Flags

Flag	Meaning
`-t`	TCP
`-u`	UDP
`-l`	Listening only
`-n`	Numeric (no DNS resolution)
`-p`	Show process (needs sudo)
`-a`	All sockets
`-s`	Summary

netstat — Legacy (Still Useful)

netstat -tuln                  # Listening ports
netstat -tulnp                 # With process names
netstat -an                    # All connections
netstat -rn                    # Routing table
netstat -i                     # Interface statistics

lsof — List Open Files

sudo lsof -i :80               # What's using port 80?
sudo lsof -i :3000             # What's using port 3000?
sudo lsof -i -P -n             # All network connections

Common Tasks

# What's listening on port 3000?
sudo ss -tlnp | grep 3000
sudo lsof -i :3000

# Established SSH connections
ss -t state established '( dport = :22 )'

# Connection count summary
ss -s

-p flag requires sudo to show process names for all connections. Without it, you'll only see processes owned by your user.

Quick Check

Which command shows what process is using port 8080?

Exercise

Run ss -tuln to list all listening ports. Identify which port SSH is listening on.