How to use netstat and ss for socket inspection

Short answer

ss and netstat display socket statistics, active connections, and listening ports.

Steps

1. List all listening ports:

ss -tlnp

2. Show active TCP connections:

ss -tunap

3. Filter by port:

ss -tlnp sport = :80

4. Legacy netstat:

netstat -tlnp

Tips

• ss is faster than netstat because it reads from kernel structures directly.
• -p shows the process using the socket (requires root for all processes).
• Use -4 or -6 to filter by IP version.

Common issues

• Missing process names: run with sudo to see all processes.
• Very high connection counts: ss handles large numbers better than netstat.