$devvkit learn --librarie netstat-&-ss-guide

netstat & ss Guide

[networking][ports][sockets][monitoring]

Network Diagnostics

Install

# ss is built into iproute2 (Linux)
# netstat is from net-tools
sudo apt install net-tools iproute2
# macOS: netstat built-in, ss not available

ss is the modern replacement for netstat on Linux. It reads socket information directly from the kernel (netlink) and is significantly faster than netstat, especially with many connections. Use ss for production debugging: netstat is deprecated on many distros.

Master `ss -tulpn`: `-t` TCP, `-u` UDP, `-l` listening only, `-p` show process, `-n` numeric. For connection states, use `ss -tan` (all TCP connections numeric) or filter by state with `ss state established`.

Netstat is still useful on macOS/BSD where ss isn't available. On Windows, use `netstat -anob` or `Get-NetTCPConnection` in PowerShell. For real-time connection monitoring, combine with `watch ss -s` for summary stats.

ss Usage

ss: listening ports· What's listening.

ss -tulpn                    # TCP + UDP, listening, with processes
ss -tulpn | grep LISTEN       # Just TCP listeners
ss -tulpn | wc -l             # Count open listeners
sudo ss -tulpn                # Show all processes (needs root for some)

ss: established· Active connections.

ss -tan                      # All TCP connections, numeric
ss -tan state established     # Only established
ss -tan sport = :80           # Source port 80
ss -tan dport = :443          # Destination port 443
ss -tan "( sport = :443 or dport = :443 )"

ss: socket details· TCP state and memory.

ss -tani                       # TCP + inode info + interface
ss -tamp                       # TCP + memory usage + more detail
ss -s                          # Summary: total sockets, TCP states
# Example output:
# TCP:   12 (estab 5, closed 0, orphaned 0, synrecv 0, timewait 0/0), ports 24

ss: filter by PID· Which process uses ports.

sudo ss -tulpn | grep nginx
# Or:
sudo ss -tulpn | grep ":80"
sudo ss -tulpn | grep "users:(("node"

netstat

netstat: macOS· Netstat on macOS/BSD.

netstat -an                   # All connections
netstat -an -p tcp             # TCP only
netstat -an | grep LISTEN      # Listening ports
netstat -nr                   # Routing table
netstat -ib                   # Interface bytes in/out
sudo lsof -i -P | grep LISTEN  # Alternative for macOS (lsof)

netstat: legacy· Classic netstat commands.

netstat -tulpn                # Linux: all listening
netstat -ant | grep 8080       # Connections on port 8080
netstat -s                     # Protocol statistics (TCP retransmits, etc.)
netstat -i                     # Interface stats
netstat -r                     # Routing table

Windows

Windows netstat· Windows equivalent.

netstat -anob                    # All connections with PID
netstat -anob | findstr LISTENING
netstat -s                       # Per-protocol stats
Get-NetTCPConnection -State Listen  # PowerShell
Get-NetUDPEndpoint               # UDP listeners (PowerShell)

Performance

Watch connections· Real-time monitoring.

watch -n 1 "ss -s"                                   # Summary updates
watch -n 1 "ss -tan state established | wc -l"         # Connection count
watch -n 2 "ss -tan '( sport = :443 )' | tail -20"     # Active HTTPS conns

# Alert on too many TIME_WAIT:
while true; do
  tw=$(ss -tan state time-wait | wc -l)
  [ $tw -gt 10000 ] && echo "ALERT: $tw TIME_WAIT connections"
  sleep 5
done

Trick: Docker containers· Map ports to containers.

# Find which container owns a port:
ss -tulpn | grep ":8080"
# Get PID, then:
docker ps --format '{{.ID}} {{.Names}}' | xargs -I{} sh -c 'echo "{} $(docker inspect --format '{{.State.Pid}}' {})"'
# Or simpler:
docker port mycontainer
docker ps --format "table {{.Names}}	{{.Ports}}"