iwantcoding.com
🔥 Daily 👥 Rooms 🏆 Top Log in Sign up

netstat / ss

By · Reviewed & last updated · Part of Linux & Bash Tutorial

netstat is the venerable tool for "what is listening on this box?"; ss is its modern replacement — faster, more accurate on busy hosts, and the only one that ships by default on current distros. Use either to debug "why is this port not bound?" and "who is the client of this connection?".

Inspect sockets, ports, and connections

EXAMPLE
# 1) Listening sockets — the most common need
ss -tlnp                       # TCP, listening, numeric, with process
ss -ulnp                       # UDP, listening, numeric, with process
# Old equivalents:
netstat -tlnp
netstat -ulnp

# Output columns
# Netid State Recv-Q Send-Q   Local Address:Port   Peer Address:Port   Process

# 2) All sockets (listening + established)
ss -tanp                       # TCP all (listening + connected)
ss -uanp                       # UDP all
ss -anp                        # everything, all protocols

# 3) Filter by port
ss -tnp 'sport = :443'         # connections TO local port 443
ss -tnp 'dport = :5432'        # connections going to a remote port 5432
ss -tnp 'sport = :443 or dport = :443'

# 4) Filter by state
ss -tn state established
ss -tn state time-wait
ss -tn state listening

# 5) Filter by remote IP
ss -tnp 'dst 10.0.0.5'
ss -tnp 'src 192.168.1.0/24'

# 6) Per-process — find what is bound to a port and the PID/process
ss -tlnp 'sport = :3000'
# Old:   netstat -tlnp | grep ':3000'
# Pick the PID then dig deeper:
ps -p $pid -o pid,user,comm,args

# 7) Connection counts by state (great for capacity questions)
ss -tan | awk 'NR>1{print $1}' | sort | uniq -c | sort -rn
# ESTAB / TIME-WAIT / CLOSE-WAIT distributions tell different stories.

# 8) How many connections from a given IP?
ss -tan 'src 203.0.113.5' | wc -l

# 9) Show socket-level details — RTT, congestion window, retransmits
ss -tinp
# Look at: rcv_buf, snd_buf, cwnd, rtt, retransmits — diagnose slow links

# 10) Watch live
watch -n 1 'ss -s'             # summary every second
ss -s                          # one-shot summary (total sockets per type/state)

# 11) Unix domain sockets
ss -xlnp                       # listening Unix sockets
ss -xanp                       # all Unix sockets
# Useful for finding which process holds /var/run/foo.sock

# 12) IPv6
ss -tlnp '[::]'
ss -tan -6

# 13) Useful one-liners
# Top 10 talkative remotes (active TCP):
ss -tan state established 'dport > 0' \
  | awk 'NR>1 {print $5}' \
  | sort \
  | uniq -c | sort -rn | head -10

# What is using up an ephemeral port range?
ss -tan | awk 'NR>1 {print $4}' | grep -oE ':[0-9]+$' | sort -t: -k2 -n | tail

# 14) Why ss over netstat
# - netstat-net-tools is deprecated; ss is iproute2 and maintained
# - ss reads /proc directly; netstat polls and is often slower on busy hosts
# - ss filters with proper grammar (sport / dport / state); netstat uses grep
# - ss shows TCP info socket-level details (RTT, cwnd) that netstat cannot

Why it matters

`ss -tlnp` is the one-line answer to "what is listening on this box?". Keep it as muscle memory; when a deploy fails because port 3000 is already bound, you find the offending process in under a second and decide whether to kill it or move yours.

Tip: Tweak the snippet with Try it Yourself », then sit the quiz at the bottom of the page.

Example

Example
ss -tulpn         # modern replacement for netstat
Try it Yourself »

Discussion

Loading…