See every socket on the box — who is listening, who is connected, and what is stuck.
netstat is gone from most modern distros, and the tool that replaced it is faster, more precise, and prints the same information in a fraction of the time. If you still reach for netstat out of habit, you are using a museum piece.
ss (socket statistics) dumps the kernel's socket table: every TCP and UDP socket, whether it is listening, established, or stuck in a weird state, plus the process that owns it. It reads the same /proc/net data netstat did, but it queries the kernel directly and is dramatically faster — on a busy box with thousands of connections, netstat can take seconds while ss returns instantly.
When a port won't bind, a service won't start, or a connection hangs, ss is the first tool to reach for. It answers the three questions that matter: what is listening on this port, who is connected to me, and is anything stuck in a half-open state? It is the diagnostic backbone of every sysadmin and the reason netstat is now a legacy command on most systems.
ss -tlnp
State Recv-Q Send-Q Local Address:Port Peer Address:PortProcess
LISTEN 0 4096 0.0.0.0:4455 0.0.0.0:*
LISTEN 0 2048 127.0.0.1:43753 0.0.0.0:* users:(("hermes",pid=2090958,fd=8))
LISTEN 0 4096 0.0.0.0:5000 0.0.0.0:*
LISTEN 0 511 0.0.0.0:5500 0.0.0.0:* users:(("MainThread",pid=408243,fd=24))
LISTEN 0 4096 0.0.0.0:5678 0.0.0.0:*
-t TCP, -l listening only, -n numeric ports (no DNS), -p show the owning process. This is the 'what is bound where' command — the first thing you run when a port won't start.
ss -tn state established '( dport = :443 or sport = :443 )'
Recv-Q Send-Q Local Address:Port Peer Address:PortProcess 0 0 192.168.1.57:52090 149.154.166.110:443 0 0 192.168.1.57:60148 149.154.166.110:443 0 0 192.168.1.57:55436 44.215.116.52:443 0 0 192.168.1.57:50570 44.215.117.206:443
ss accepts a filter expression after the flags. This shows only established TCP connections to or from port 443 — every active HTTPS connection on the box, with the remote IP.
ss -s
Total: 1346 TCP: 452 (estab 221, closed 169, orphaned 1, timewait 52) Transport Total IP IPv6 RAW 1 0 1 UDP 20 19 1 TCP 283 262 21 INET 304 281 23 FRAG 0 0 0
-s prints a summary of all sockets by transport and state. The 'estab 221' line tells you how many live connections exist right now — a quick health read for a busy server.
| Flag | Meaning |
|---|---|
-t | show TCP sockets only |
-u | show UDP sockets only |
-l | listening sockets only (what is bound and waiting) |
-a | all sockets, listening and established (default shows established) |
-n | numeric — show ports and IPs without DNS or service-name lookups |
-p | show the process (and PID) that owns each socket |
-s | summary of socket counts by transport and state |
-o | show timer info — useful for spotting stuck or half-open connections |
ss was written by Alexey Kuznetsov, the same kernel developer who wrote the modern TCP/IP stack in Linux 2.2, and it shipped as part of the iproute2 suite. It was designed from the start to read the kernel's socket tables directly and efficiently, which is why it leaves netstat in the dust on busy systems.
netstat came from the net-tools package, which stopped being maintained as the kernel's networking internals evolved. Modern distros dropped it from default installs, and the iproute2 tools — ip, ss, and their siblings — became the standard. ss is not just a faster netstat; its filter expressions let you query sockets the way you query a database.