$devvkit learn --librarie netstat-&-ss-guide
netstat & ss Guide
[networking][ports][sockets][monitoring]
Network Diagnostics
Install
# ss is built into iproute2 (Linux) # netstat is from net-tools sudo apt install net-tools iproute2 # macOS: netstat built-in, ss not available
ss is the modern replacement for netstat on Linux. It reads socket information directly from the kernel (netlink) and is significantly faster than netstat, especially with many connections. Use ss for production debugging — netstat is deprecated on many distros.
Master `ss -tulpn`: `-t` TCP, `-u` UDP, `-l` listening only, `-p` show process, `-n` numeric. For connection states, use `ss -tan` (all TCP connections numeric) or filter by state with `ss state established`.
Netstat is still useful on macOS/BSD where ss isn't available. On Windows, use `netstat -anob` or `Get-NetTCPConnection` in PowerShell. For real-time connection monitoring, combine with `watch ss -s` for summary stats.
ss Usage
ss — listening ports— What's listening.
ss -tulpn # TCP + UDP, listening, with processes ss -tulpn | grep LISTEN # Just TCP listeners ss -tulpn | wc -l # Count open listeners sudo ss -tulpn # Show all processes (needs root for some)
ss — established— Active connections.
ss -tan # All TCP connections, numeric ss -tan state established # Only established ss -tan sport = :80 # Source port 80 ss -tan dport = :443 # Destination port 443 ss -tan "( sport = :443 or dport = :443 )"
ss — socket details— TCP state and memory.
ss -tani # TCP + inode info + interface ss -tamp # TCP + memory usage + more detail ss -s # Summary: total sockets, TCP states # Example output: # TCP: 12 (estab 5, closed 0, orphaned 0, synrecv 0, timewait 0/0), ports 24
ss — filter by PID— Which process uses ports.
sudo ss -tulpn | grep nginx
# Or:
sudo ss -tulpn | grep ":80"
sudo ss -tulpn | grep "users:(("node"netstat
netstat — macOS— Netstat on macOS/BSD.
netstat -an # All connections netstat -an -p tcp # TCP only netstat -an | grep LISTEN # Listening ports netstat -nr # Routing table netstat -ib # Interface bytes in/out sudo lsof -i -P | grep LISTEN # Alternative for macOS (lsof)
netstat — legacy— Classic netstat commands.
netstat -tulpn # Linux: all listening netstat -ant | grep 8080 # Connections on port 8080 netstat -s # Protocol statistics (TCP retransmits, etc.) netstat -i # Interface stats netstat -r # Routing table
Windows
Windows netstat— Windows equivalent.
netstat -anob # All connections with PID netstat -anob | findstr LISTENING netstat -s # Per-protocol stats Get-NetTCPConnection -State Listen # PowerShell Get-NetUDPEndpoint # UDP listeners (PowerShell)
Performance
Watch connections— Real-time monitoring.
watch -n 1 "ss -s" # Summary updates watch -n 1 "ss -tan state established | wc -l" # Connection count watch -n 2 "ss -tan '( sport = :443 )' | tail -20" # Active HTTPS conns # Alert on too many TIME_WAIT: while true; do tw=$(ss -tan state time-wait | wc -l) [ $tw -gt 10000 ] && echo "ALERT: $tw TIME_WAIT connections" sleep 5 done
Trick: Docker containers— Map ports to containers.
# Find which container owns a port:
ss -tulpn | grep ":8080"
# Get PID, then:
docker ps --format '{{.ID}} {{.Names}}' | xargs -I{} sh -c 'echo "{} $(docker inspect --format '{{.State.Pid}}' {})"'
# Or simpler:
docker port mycontainer
docker ps --format "table {{.Names}} {{.Ports}}"