LFCA 47 🐧 Checking Open Ports — ss, netstat
A port is a number that identifies a service on a host. The web server listens on the 80 or the 443, the SSH daemon listens on the 22, the database listens on the 5432. When a connection arrives, the kernel uses the port to route the packet to the right process. The two commands that show the open ports, the listening sockets, and the active connections are ss and its predecessor netstat. The ss is the modern, and the netstat is the legacy — it is deprecated on most distributions but still appears in older documentation and on the older systems. The two answer the questions that matter in the diagnosis: what is listening, on which interface, on which port, and which process owns it. This chapter covers the socket’s model, the ss‘s output, the netstat‘s output, the common options, the TCP’s states, the process’s attribution, the patterns for the security audit and the diagnosis, and the migration from the netstat to the ss. It builds on LFCA 41 through 46 and prepares the ground for the firewall’s material.
Key point: A socket is the combination of the IP address and the port. The ss and the netstat show the sockets, and the two have the similar output. The ss -tlnp shows the TCP’s listening sockets, and the -u adds the UDP, the -a adds all, the -n shows the numbers instead of the names, and the -p shows the process. The LISTEN state is the server waiting for the connection, the ESTABLISHED is the active connection, the TIME_WAIT is the recently closed, and the CLOSE_WAIT is the connection waiting for the local application to close. The ss is the faster and the modern; the netstat is the slower and the legacy. The ports below the 1024 are the privileged, and the 0.0.0.0 is the all interfaces, and the 127.0.0.1 is the loopback only.
The socket’s model
A socket is the endpoint of a connection, and it is the combination of the IP address and the port. The server’s socket is the listening, and the client’s is the connected. The two are the pair, and the pair is the connection.
The five-tuple. A connection is identified by the five-tuple: the protocol, the local’s address, the local’s port, the remote’s address, the remote’s port. The five are the unique, and the unique is the connection’s.
The listening’s socket. The server’s socket is the listening, and the listening is the LISTEN‘s state. The local’s address is the 0.0.0.0 (the all) or the specific, and the local’s port is the service’s. The two are the pair, and the pair is the listening’s.
The connected’s socket. The client’s socket is the connected, and the connected is the ESTABLISHED‘s state. The local’s and the remote’s are the pair, and the pair is the connection’s.
Why the socket’s model matters. The socket’s model is the connection’s, and the connection’s is the diagnosis. The ss and the netstat show the sockets, and the sockets are the model. The two are the pair, and the pair is the diagnostic.
Why the port’s number matters. The port’s number is the service’s, and the service’s is the process’s. The 22 is the SSH’s, the 80 is the HTTP’s, the 443 is the HTTPS’s. The three are the common, and the common is the vocabulary.
Why the privileged’s ports matter. The ports below the 1024 are the privileged, and the privileged is the root’s. The binding requires the root, and the root is the privilege’s. The two are the pair, and the pair is the security’s.
Why the all-interfaces’s address matters. The 0.0.0.0 is the all’s, and the all’s is the every’s. The server binds the 0.0.0.0, and the every interface is the listening’s. The two are the pair, and the pair is the exposure’s.
Why the loopback’s address matters. The 127.0.0.1 is the loopback’s, and the loopback’s is the local’s. The server binds the 127.0.0.1, and the local only is the listening’s. The two are the pair, and the pair is the safe’s.
Why the address’s choice matters. The address’s choice is the exposure’s, and the exposure’s is the security’s. The 0.0.0.0 is the exposed’s, and the 127.0.0.1 is the local’s. The two are the choice, and the choice is the design.
Why the socket’s family matters. The socket’s family is the IPv4’s or the IPv6’s, and the family is the specific’s. The tcp is the IPv4’s, and the tcp6 is the IPv6’s. The two are the pair, and the pair is the diagnostic.
The ss‘s basic usage
The ss is the modern, and it is the iproute2‘s. The basic usage is the ss, and the output is the sockets’.
ss
# Netid State Recv-Q Send-Q Local Address:Port Peer Address:Port
# tcp ESTAB 0 0 192.168.1.100:22 192.168.1.50:54321
# tcp ESTAB 0 0 192.168.1.100:443 192.168.1.60:54322The Netid is the protocol’s, the State is the socket’s, the Recv-Q and the Send-Q are the queues’, and the Local Address:Port and the Peer Address:Port are the addresses’.
Why the ss‘s output matters. The ss‘s output is the sockets’, and the sockets’ is the model. The Netid, the State, the Recv-Q, the Send-Q, the Local, the Peer are the six. The six are the pair, and the pair is the diagnostic.
Why the Netid matters. The Netid is the protocol’s, and the protocol’s is the tcp, the udp, the tcp6, the udp6, the unix. The five are the common, and the common is the vocabulary.
Why the State matters. The State is the socket’s, and the socket’s is the LISTEN, the ESTAB, the TIME-WAIT, the CLOSE-WAIT. The four are the common, and the common is the diagnosis.
Why the Recv-Q and the Send-Q matter. The Recv-Q is the receive’s queue, and the Send-Q is the send’s queue. The two are the buffers’, and the buffers’ is the performance’s. The two are the pair, and the pair is the backlog’s.
Why the queues matter for the listening’s socket. The listening’s Recv-Q is the backlog’s, and the Send-Q is the max’s. The two are the pair, and the pair is the backlog’s.
Why the queues matter for the connected’s socket. The connected’s Recv-Q is the unread’s, and the Send-Q is the unsent’s. The two are the pair, and the pair is the application’s.
Why the Local Address:Port matters. The Local Address:Port is the local’s, and the local’s is the server’s. The 192.168.1.100:22 is the SSH’s, and the 192.168.1.100:443 is the HTTPS’s. The two are the pair, and the pair is the diagnostic.
Why the Peer Address:Port matters. The Peer Address:Port is the remote’s, and the remote’s is the client’s. The 192.168.1.50:54321 is the client’s, and the 192.168.1.60:54322 is the other’s. The two are the pair, and the pair is the connection’s.
Why the ss‘s default output matters. The ss‘s default is the connected’s, and the connected’s is the ESTAB‘s. The -a is the all’s, and the all’s is the listening’s and the connected’s. The two are the pair, and the pair is the option’s.
Why the ss‘s -a matters. The -a is the all’s, and the all’s is the complete’s.
ss -a
# Netid State Recv-Q Send-Q Local Address:Port Peer Address:Port
# tcp LISTEN 0 128 0.0.0.0:22 0.0.0.0:*
# tcp ESTAB 0 0 192.168.1.100:22 192.168.1.50:54321The -a is the all’s, and the all’s is the complete’s. The LISTEN and the ESTAB are the both’s, and the both is the complete’s. The two are the pair, and the pair is the option’s.
Why the ss‘s -l matters. The -l is the listening’s, and the listening’s is the server’s.
ss -l
# Netid State Recv-Q Send-Q Local Address:Port Peer Address:Port
# tcp LISTEN 0 128 0.0.0.0:22 0.0.0.0:*
# tcp LISTEN 0 511 0.0.0.0:80 0.0.0.0:*
# tcp LISTEN 0 511 0.0.0.0:443 0.0.0.0:*The -l is the listening’s, and the listening’s is the server’s. The three are the LISTEN‘s, and the LISTEN‘s is the server’s. The two are the pair, and the pair is the option’s.
Why the ss‘s -t matters. The -t is the TCP’s, and the TCP’s is the stream’s.
ss -tThe -t is the TCP’s, and the TCP’s is the stream’s. The two are the pair, and the pair is the option’s.
Why the ss‘s -u matters. The -u is the UDP’s, and the UDP’s is the datagram’s.
ss -uThe -u is the UDP’s, and the UDP’s is the datagram’s. The two are the pair, and the pair is the option’s.
Why the ss‘s -n matters. The -n is the numeric’s, and the numeric’s is the no-DNS’s.
ss -n
# tcp ESTAB 0 0 192.168.1.100:22 192.168.1.50:54321The -n is the numeric’s, and the numeric’s is the no-DNS’s. The 22 is the number’s, and the ssh is the name’s. The two are the pair, and the pair is the speed’s.
Why the -n matters. The -n is the speed’s, and the speed’s is the no-reverse-DNS’s. The reverse’s DNS is the slow’s, and the slow is the delay’s. The two are the pair, and the pair is the fast’s.
Why the ss‘s -p matters. The -p is the process’s, and the process’s is the attribution’s.
ss -p
# tcp ESTAB 0 0 192.168.1.100:22 192.168.1.50:54321
# users:(("sshd",pid=1234,fd=3))The -p is the process’s, and the process’s is the attribution’s. The users:(("sshd",pid=1234,fd=3)) is the process’s, and the process’s is the attribution’s. The two are the pair, and the pair is the option’s.
Why the -p matters. The -p is the attribution’s, and the attribution’s is the diagnosis’s. The process’s is the service’s, and the service’s is the port’s. The two are the pair, and the pair is the diagnostic.
Why the -p requires the root. The -p requires the root, and the root is the process’s. The other user’s processes are the hidden, and the hidden is the privacy’s. The two are the pair, and the pair is the permission’s.
Why the ss‘s -s matters. The -s is the summary’s, and the summary’s is the statistics’.
ss -s
# Total: 123
# TCP: 45 (estab 20, closed 10, orphaned 0, timewait 5)
# UDP: 5The -s is the summary’s, and the summary’s is the statistics’. The Total, the TCP, the UDP are the three, and the three are the summary’s. The two are the pair, and the pair is the option’s.
Why the -s matters. The -s is the summary’s, and the summary’s is the overview’s. The overview’s is the diagnostic’s, and the diagnostic’s is the first’s. The two are the pair, and the pair is the option’s.
The combined options
The ss‘s options are the combined, and the combined is the specific. The -tlnp is the TCP’s, the listening’s, the numeric’s, the process’s.
The ss -tlnp. The -t is the TCP’s, the -l is the listening’s, the -n is the numeric’s, the -p is the process’s.
sudo ss -tlnp
# State Recv-Q Send-Q Local Address:Port Peer Address:Port Process
# LISTEN 0 128 0.0.0.0:22 0.0.0.0:* users:(("sshd",pid=1234,fd=3))
# LISTEN 0 511 0.0.0.0:80 0.0.0.0:* users:(("nginx",pid=5678,fd=6))
# LISTEN 0 511 0.0.0.0:443 0.0.0.0:* users:(("nginx",pid=5678,fd=7))The sudo ss -tlnp is the TCP’s, the listening’s, the numeric’s, the process’s. The three are the servers’, and the servers’ is the listening’s. The two are the pair, and the pair is the option’s.
Why the ss -tlnp matters. The ss -tlnp is the common, and the common is the security’s. The listening’s servers are the list’s, and the list’s is the audit’s. The two are the pair, and the pair is the diagnosis’s.
The ss -tunlp. The -u adds the UDP’s, and the UDP’s is the datagram’s.
sudo ss -tunlp
# The TCP's and the UDP's listening's.The -tunlp is the both’s, and the both’s is the complete’s. The TCP’s and the UDP’s are the two, and the two are the complete’s. The two are the pair, and the pair is the option’s.
Why the -tunlp matters. The -tunlp is the both’s, and the both’s is the complete’s. The DNS’s UDP’s 53 is the example, and the example is the UDP’s. The two are the pair, and the pair is the diagnosis’s.
The ss -tanp. The -a is the all’s, and the all’s is the both’s.
sudo ss -tanp
# The listening's and the established's.The -tanp is the all’s, and the all’s is the both’s. The listening’s and the established’s are the two, and the two are the complete’s. The two are the pair, and the pair is the option’s.
Why the -tanp matters. The -tanp is the all’s, and the all’s is the complete’s. The established’s are the active’s, and the active’s is the connection’s. The two are the pair, and the pair is the diagnostic’s.
The ss -s‘s summary. The -s is the summary’s, and the summary’s is the overview’s.
ss -s
# Total: 123
# TCP: 45 (estab 20, closed 10, orphaned 0, timewait 5)
# UDP: 5The ss -s is the summary’s, and the summary’s is the overview’s. The Total, the TCP, the UDP are the three, and the three are the summary’s. The two are the pair, and the pair is the option’s.
Why the -s matters. The -s is the summary’s, and the summary’s is the overview’s. The overview’s is the diagnostic’s, and the diagnostic’s is the first’s. The two are the pair, and the pair is the option’s.
Why the options’s combination matters. The options’s combination is the specific’s, and the specific’s is the diagnosis’s. The -tlnp is the audit’s, the -tunlp is the complete’s, the -tanp is the both’s. The three are the common, and the common is the vocabulary.
The netstat‘s comparison
The netstat is the legacy, and it is the net-tools‘s. The output is the similar to the ss‘s, and the options are the similar too.
netstat -tlnp
# Active Internet connections (only servers)
# Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
# tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 1234/sshd
# tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN 5678/nginx
# tcp 0 0 0.0.0.0:443 0.0.0.0:* LISTEN 5678/nginxThe netstat -tlnp is the TCP’s, the listening’s, the numeric’s, the process’s. The Proto, the Recv-Q, the Send-Q, the Local Address, the Foreign Address, the State, the PID/Program name are the seven. The seven are the pair, and the pair is the output’s.
Why the netstat matters. The netstat is the legacy, and the legacy is the older’s. The older’s is the documentation’s, and the documentation’s is the reference. The two are the pair, and the pair is the migration’s.
Why the netstat is deprecated. The netstat is the deprecated, and the deprecated is the net-tools‘s. The net-tools is the legacy, and the legacy is the iproute2‘s. The two are the pair, and the pair is the modern’s.
Why the netstat‘s output differs. The netstat‘s output has the Proto, the Recv-Q, the Send-Q, the Local Address, the Foreign Address, the State, the PID/Program name. The ss‘s has the Netid, the State, the Recv-Q, the Send-Q, the Local Address:Port, the Peer Address:Port, the Process. The two are the similar, and the similar is the migration’s.
Why the netstat‘s -r matters. The netstat -r is the route’s, and the route’s is the ip route‘s.
netstat -r
# Kernel IP routing table
# Destination Gateway Genmask Flags MSS Window irtt Iface
# 0.0.0.0 192.168.1.1 0.0.0.0 UG 0 0 0 eth0The netstat -r is the route’s, and the route’s is the ip route‘s. The two are the pair, and the pair is the migration’s.
Why the netstat -i matters. The netstat -i is the interface’s, and the interface’s is the ip -s link‘s.
netstat -i
# Kernel Interface table
# Iface MTU RX-OK RX-ERR RX-DRP RX-OVR TX-OK TX-ERR TX-DRP TX-OVR Flg
# eth0 1500 12345 0 0 0 12345 0 0 0 BMRUThe netstat -i is the interface’s, and the interface’s is the ip -s link‘s. The two are the pair, and the pair is the migration’s.
Why the migration matters. The migration is the net-tools‘s to the iproute2‘s, and the iproute2‘s is the modern’s. The ss is the netstat‘s replacement, and the ip is the ifconfig‘s and the route‘s. The three are the pair, and the pair is the modern’s.
Why the netstat‘s install matters. The netstat‘s install is the net-tools‘s, and the net-tools‘s is the optional’s.
sudo apt install net-tools # the Debian's
sudo dnf install net-tools # the Fedora'sThe net-tools is the optional, and the optional is the legacy’s. The two are the pair, and the pair is the install’s.
Why the install matters. The install is the modern’s, and the modern’s is the ss‘s. The ss is the installed, and the installed is the iproute2‘s. The two are the pair, and the pair is the default’s.
The TCP’s states
The TCP’s states are the LISTEN, the ESTABLISHED, the TIME_WAIT, the CLOSE_WAIT, the SYN_SENT, the SYN_RECV, the FIN_WAIT1, the FIN_WAIT2, the CLOSING, the LAST_ACK, the CLOSED. The eleven are the complete, and the complete is the TCP’s.
The LISTEN. The LISTEN is the server’s, and the server’s is the waiting’s. The server is the waiting for the connection, and the waiting is the socket’s. The two are the pair, and the pair is the listening’s.
The ESTABLISHED. The ESTABLISHED is the connected’s, and the connected’s is the active’s. The connection is the open, and the open is the data’s. The two are the pair, and the pair is the active’s.
The TIME_WAIT. The TIME_WAIT is the recently’s, and the recently’s is the closed’s. The connection is the closed, and the closed is the waiting for the 2MSL. The two are the pair, and the pair is the timeout’s.
Why the TIME_WAIT matters. The TIME_WAIT is the recently’s, and the recently’s is the normal’s. The high’s count is the normal for the busy’s server, and the normal is the expected’s. The two are the pair, and the pair is the diagnostic’s.
Why the TIME_WAIT‘s count matters. The TIME_WAIT‘s count is the high’s, and the high’s is the ports’s. The ports’s is the exhausted’s, and the exhausted is the problem’s. The two are the pair, and the pair is the diagnosis’s.
The CLOSE_WAIT. The CLOSE_WAIT is the waiting’s, and the waiting’s is the application’s. The remote is the closed, and the closed is the local’s waiting. The two are the pair, and the pair is the application’s.
Why the CLOSE_WAIT matters. The CLOSE_WAIT is the application’s, and the application’s is the leak’s. The high’s count is the application’s bug, and the bug is the not-closing’s. The two are the pair, and the pair is the diagnostic’s.
Why the CLOSE_WAIT‘s count matters. The CLOSE_WAIT‘s count is the application’s, and the application’s is the resource’s. The high’s count is the leak, and the leak is the bug. The two are the pair, and the pair is the diagnosis’s.
The SYN_SENT. The SYN_SENT is the connecting’s, and the connecting’s is the client’s. The client is the sent the SYN, and the sent is the waiting for the SYN-ACK. The two are the pair, and the pair is the connecting’s.
The SYN_RECV. The SYN_RECV is the receiving’s, and the receiving’s is the server’s. The server is the received the SYN, and the received is the waiting for the ACK. The two are the pair, and the pair is the half-open’s.
Why the SYN_RECV matters. The SYN_RECV is the receiving’s, and the receiving’s is the half-open’s. The high’s count is the SYN flood’s, and the flood is the attack’s. The two are the pair, and the pair is the security’s.
Why the states matter. The states are the TCP’s, and the TCP’s is the connection’s. The eleven are the complete, and the complete is the diagnosis’s. The two are the pair, and the pair is the vocabulary.
The patterns
The patterns are the audit’s, the diagnosis’s, and the monitoring’s. The three are the common, and the common is the use.
The pattern 1: the listening’s audit. The ss -tlnp is the audit’s, and the audit’s is the security’s.
sudo ss -tlnp
# The listening's servers.The sudo ss -tlnp is the audit’s, and the audit’s is the security’s. The listening’s servers are the list’s, and the list’s is the review’s. The two are the pair, and the pair is the audit’s.
Why the pattern 1 matters. The pattern 1 is the audit’s, and the audit’s is the security’s. The unexpected’s listener is the risk’s, and the risk’s is the review’s. The two are the pair, and the pair is the diagnosis’s.
The pattern 2: the established’s view. The ss -tanp is the established’s, and the established’s is the active’s.
sudo ss -tanp
# The listening's and the established's.The sudo ss -tanp is the established’s, and the established’s is the active’s. The active’s is the connection’s, and the connection’s is the diagnostic’s. The two are the pair, and the pair is the pattern’s.
Why the pattern 2 matters. The pattern 2 is the active’s, and the active’s is the connection’s. The established’s is the remote’s, and the remote’s is the diagnostic’s. The two are the pair, and the pair is the diagnosis’s.
The pattern 3: the process’s finding. The ss -tlnp | grep <port> is the process’s, and the process’s is the port’s.
sudo ss -tlnp | grep :80
# LISTEN 0 511 0.0.0.0:80 0.0.0.0:* users:(("nginx",pid=5678,fd=6))The sudo ss -tlnp | grep :80 is the process’s, and the process’s is the port’s. The nginx is the process’s, and the process’s is the attribution’s. The two are the pair, and the pair is the pattern’s.
Why the pattern 3 matters. The pattern 3 is the port’s, and the port’s is the process’s. The “which process owns the port?” is the question’s, and the question’s is the diagnosis’s. The two are the pair, and the pair is the pattern’s.
The pattern 4: the count’s monitoring. The ss -s is the count’s, and the count’s is the monitoring’s.
ss -s
# Total: 123
# TCP: 45 (estab 20, closed 10, orphaned 0, timewait 5)The ss -s is the count’s, and the count’s is the monitoring’s. The Total, the TCP, the UDP are the three, and the three are the count’s. The two are the pair, and the pair is the pattern’s.
Why the pattern 4 matters. The pattern 4 is the count’s, and the count’s is the monitoring’s. The count’s is the baseline’s, and the baseline’s is the change’s. The two are the pair, and the pair is the pattern’s.
The pattern 5: the state’s filter. The ss -tan state established is the state’s, and the state’s is the specific’s.
ss -tan state established
# The established's only.The ss -tan state established is the state’s, and the state’s is the specific’s. The two are the pair, and the pair is the pattern’s.
Why the pattern 5 matters. The pattern 5 is the state’s, and the state’s is the specific’s. The time-wait is the specific’s, and the specific’s is the diagnosis’s. The two are the pair, and the pair is the pattern’s.
Why the patterns matter. The patterns are the vocabulary, and the vocabulary is the fluency. The five are the common, and the common is the practice. The two are the pair, and the pair is the skill.
Complete Example Session
# ============================================
# PART 1: THE BASIC SS
# ============================================
ss
# Netid State Recv-Q Send-Q Local Address:Port Peer Address:Port
# tcp ESTAB 0 0 192.168.1.100:22 192.168.1.50:54321
# tcp ESTAB 0 0 192.168.1.100:443 192.168.1.60:54322
# ============================================
# PART 2: THE LISTENING'S AUDIT
# ============================================
sudo ss -tlnp
# State Recv-Q Send-Q Local Address:Port Peer Address:Port Process
# LISTEN 0 128 0.0.0.0:22 0.0.0.0:* users:(("sshd",pid=1234,fd=3))
# LISTEN 0 511 0.0.0.0:80 0.0.0.0:* users:(("nginx",pid=5678,fd=6))
# LISTEN 0 511 0.0.0.0:443 0.0.0.0:* users:(("nginx",pid=5678,fd=7))
# ============================================
# PART 3: THE TCP AND THE UDP
# ============================================
sudo ss -tunlp
# The TCP's and the UDP's listening's.
# ============================================
# PART 4: THE ALL'S
# ============================================
sudo ss -tanp
# The listening's and the established's.
# ============================================
# PART 5: THE SUMMARY
# ============================================
ss -s
# Total: 123
# TCP: 45 (estab 20, closed 10, orphaned 0, timewait 5)
# UDP: 5
# ============================================
# PART 6: THE NETSTAT
# ============================================
netstat -tlnp
# Active Internet connections (only servers)
# Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
# tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 1234/sshd
# tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN 5678/nginx
# tcp 0 0 0.0.0.0:443 0.0.0.0:* LISTEN 5678/nginx
# ============================================
# PART 7: THE PORT'S PROCESS
# ============================================
sudo ss -tlnp | grep :80
# LISTEN 0 511 0.0.0.0:80 0.0.0.0:* users:(("nginx",pid=5678,fd=6))
# ============================================
# PART 8: THE STATE'S FILTER
# ============================================
ss -tan state established
# The established's only.
ss -tan state time-wait
# The time-wait's only.
# ============================================
# PART 9: THE STATES
# ============================================
# LISTEN → the server's waiting
# ESTABLISHED → the active's connection
# TIME_WAIT → the recently's closed
# CLOSE_WAIT → the local's waiting
# ============================================
# PART 10: WHAT NOT TO DO
# ============================================
# Don't use the netstat on the modern
# The ss is the modern. // ⚠️
# Don't forget the -n for the speed
# The reverse's DNS is the slow's. // ⚠️
# Don't forget the -p for the process
# The process's is the attribution's. // ⚠️
# Don't forget the root for the -p
# The -p requires the root. // ⚠️
# Don't ignore the TIME_WAIT's count
# The high's is the normal's, but the very high's is the problem's.│# ⚠️
# Don't ignore the CLOSE_WAIT's count
# The high's is the application's bug. // ⚠️The ten parts cover the basic ss, the listening’s audit, the TCP and the UDP, the all’s, the summary, the netstat, the port’s process, the state’s filter, the states, and the anti-patterns.
Quick Reference
The ss‘s Options
| The option | The purpose |
|---|---|
The -t | The TCP |
The -u | The UDP |
The -l | The listening |
The -a | The all |
The -n | The numeric |
The -p | The process |
The -s | The summary |
The -4 | The IPv4 |
The -6 | The IPv6 |
The Common Combinations
| The combination | The purpose |
|---|---|
The -tlnp | The TCP’s listening’s |
The -tunlp | The TCP’s and the UDP’s |
The -tanp | The all’s |
The -tlnp | grep :80 | The port’s process |
The TCP’s States
| The state | The meaning |
|---|---|
The LISTEN | The server’s waiting |
The ESTABLISHED | The active’s connection |
The TIME_WAIT | The recently’s closed |
The CLOSE_WAIT | The local’s waiting |
The SYN_SENT | The client’s connecting |
The SYN_RECV | The server’s half-open |
The netstat‘s Options
| The option | The purpose |
|---|---|
The -t | The TCP |
The -u | The UDP |
The -l | The listening |
The -a | The all |
The -n | The numeric |
The -p | The process |
The -r | The route |
The -i | The interface |
The Addresses
| The address | The meaning |
|---|---|
The 0.0.0.0 | The all interfaces |
The 127.0.0.1 | The loopback only |
The :: | The all interfaces (the IPv6) |
The ::1 | The loopback only (the IPv6) |
The Migration
| The legacy | The modern |
|---|---|
The netstat -tlnp | The ss -tlnp |
The netstat -r | The ip route |
The netstat -i | The ip -s link |
The ifconfig | The ip addr |
Best Practices
✅ Do This:
# Use the ss for the modern
sudo ss -tlnp # ✅
# Use the -n for the speed
sudo ss -tlnpn # ✅
# Use the -p for the process
sudo ss -tlnp # ✅
# Use the grep for the port
sudo ss -tlnp | grep :80 # ✅
# Use the -s for the summary
ss -s # ✅
# Use the state's filter
ss -tan state established # ✅
# Use the netstat only when needed
netstat -tlnp # the legacy # ✅
# Use the -n on the netstat too
netstat -tlnp # ✅❌ Don’t Do This:
# Don't use the netstat on the modern
netstat -tlnp # the deprecated // ⚠️
# Don't forget the -n
sudo ss -tlp # the slow // ⚠️
# Don't forget the -p
sudo ss -tln # the no process // ⚠️
# Don't forget the root for the -p
ss -tlnp # the no process for the other users // ⚠️
# Don't ignore the TIME_WAIT's count
# The very high's is the problem's. // ⚠️
# Don't ignore the CLOSE_WAIT's count
# The high's is the application's bug. // ⚠️Common Pitfalls
| Pitfall | Problem | Solution |
|---|---|---|
The netstat‘s use | The deprecated | The ss |
The missing -n | The slow | The -n |
The missing -p | The no process | The -p |
| The missing root | The no process | The sudo |
The TIME_WAIT‘s high | The ports’s | The check |
The CLOSE_WAIT‘s high | The bug | The application |
| The wrong address | The exposure | The 0.0.0.0 vs the 127.0.0.1 |
| The family’s | The separate | The -4 or the -6 |
Real-World Examples
1. The basic ss
ss2. The listening’s
sudo ss -tlnp3. The TCP and the UDP
sudo ss -tunlp4. The all’s
sudo ss -tanp5. The summary
ss -s6. The port’s process
sudo ss -tlnp | grep :807. The state’s filter
ss -tan state established8. The netstat
netstat -tlnp9. The route
netstat -r10. The interface
netstat -iVisual: The Socket’s Model
┌──────────────────────────────────────────────────────────┐
│ THE FIVE-TUPLE │
│ The protocol │
│ The local's address │
│ The local's port │
│ The remote's address │
│ The remote's port │
│ │
│ THE LISTENING'S │
│ The local: 0.0.0.0:22 │
│ The remote: 0.0.0.0:* │
│ The state: LISTEN │
│ │
│ THE ESTABLISHED'S │
│ The local: 192.168.1.100:22 │
│ The remote: 192.168.1.50:54321 │
│ The state: ESTAB │
│ │
└──────────────────────────────────────────────────────────┘Visual: The ss -tlnp‘s Output
┌──────────────────────────────────────────────────────────┐
│ State Recv-Q Send-Q Local Address:Port Peer Address:Port Process│
│ │ │ │ │ │ │
│ │ │ │ │ │ └── The process│
│ │ │ │ │ └── The remote's │
│ │ │ │ └── The local's │
│ │ │ └── The send's queue │
│ │ └── The receive's queue │
│ └── The state │
│ │
│ LISTEN 0 128 0.0.0.0:22 0.0.0.0:* users:(("sshd",pid=1234,fd=3))│
│ LISTEN 0 511 0.0.0.0:80 0.0.0.0:* users:(("nginx",pid=5678,fd=6))│
│ │
└──────────────────────────────────────────────────────────┘Visual: The TCP’s States
┌──────────────────────────────────────────────────────────┐
│ THE SERVER'S SIDE │
│ LISTEN → the waiting for the connection │
│ SYN_RECV → the half-open │
│ ESTABLISHED → the connected │
│ CLOSE_WAIT → the remote's closed, the local's wait │
│ LAST_ACK → the final's ACK │
│ CLOSED → the closed │
│ │
├──────────────────────────────────────────────────────────┤
│ THE CLIENT'S SIDE │
│ SYN_SENT → the connecting │
│ ESTABLISHED → the connected │
│ FIN_WAIT1 → the local's closed │
│ FIN_WAIT2 → the remote's ACK'd │
│ TIME_WAIT → the 2MSL's wait │
│ CLOSED → the closed │
│ │
│ The TIME_WAIT is the normal's, and the CLOSE_WAIT is │
│ the application's. │
│ │
└──────────────────────────────────────────────────────────┘Visual: The Addresses
┌──────────────────────────────────────────────────────────┐
│ 0.0.0.0:22 │
│ The all interfaces. │
│ The exposure's. │
│ │
├──────────────────────────────────────────────────────────┤
│ 127.0.0.1:22 │
│ The loopback only. │
│ The local's. │
│ │
├──────────────────────────────────────────────────────────┤
│ 192.168.1.100:22 │
│ The specific interface. │
│ The specific's. │
│ │
├──────────────────────────────────────────────────────────┤
│ [::]:22 │
│ The all interfaces (the IPv6). │
│ The exposure's. │
│ │
├──────────────────────────────────────────────────────────┤
│ [::1]:22 │
│ The loopback only (the IPv6). │
│ The local's. │
│ │
└──────────────────────────────────────────────────────────┘Visual: The Migration
┌──────────────────────────────────────────────────────────┐
│ THE LEGACY │
│ netstat -tlnp → the ss -tlnp │
│ netstat -tunlp → the ss -tunlp │
│ netstat -r → the ip route │
│ netstat -i → the ip -s link │
│ ifconfig → the ip addr │
│ route → the ip route │
│ │
│ THE MODERN │
│ The ss is the netstat's replacement, and the ip is │
│ the ifconfig's and the route's. │
│ │
└──────────────────────────────────────────────────────────┘Summary
| Item | Value |
|---|---|
The ss | The modern’s socket’s tool |
The netstat | The legacy’s |
The -tlnp | The TCP’s listening’s |
The -tunlp | The TCP’s and the UDP’s |
The -tanp | The all’s |
The -s | The summary |
The LISTEN | The server’s |
The ESTABLISHED | The active’s |
The TIME_WAIT | The recently’s closed |
The CLOSE_WAIT | The application’s |
The 0.0.0.0 | The all interfaces |
The 127.0.0.1 | The loopback |
Key takeaways:
- The
ssis the modern, and thenetstatis the legacy — thessis faster and is the default on the modern distributions - The
ss -tlnpshows the TCP’s listening’s sockets with the process — it is the security audit’s first command - The
-nshows the numbers instead of the names — the reverse’s DNS is the slow, and the-nis the fast - The
-pshows the process, and it requires the root — the other users’ processes are hidden without the root - The
LISTENis the server’s waiting, and theESTABLISHEDis the active’s — the two are the common - The
TIME_WAITis the recently’s closed and is the normal — the very high’s count is the ports’ exhaustion’s - The
CLOSE_WAITis the application’s waiting — the high’s count is the application’s bug - The
0.0.0.0is the all interfaces, and the127.0.0.1is the loopback — the exposure’s choice is the security’s - The
ss -sis the summary — theTotal, theTCP, theUDPare the overview’s - The migration from the
netstatto thessis theiproute2‘s — thessreplaces thenetstat, and theipreplaces theifconfigand theroute
Remember: The ss and the netstat show the sockets, and the sockets are the connections. The -tlnp is the listening’s audit, and the -tanp is the all’s. The LISTEN and the ESTABLISHED are the common states, and the TIME_WAIT and the CLOSE_WAIT are the diagnostic’s. The 0.0.0.0 is the exposure’s, and the 127.0.0.1 is the safe’s. The ss is the modern, and the netstat is the legacy. The open ports are the security’s, and the security’s is the discipline.
Stop using slow, ad-bloated tool sites! 🤮
🔎 Search “KandZ Tools” on Google to use many professional utilities for free.
KandZ.me is the ultimate minimalist hub for:
✅ Finance (Mortgage, Interest, Inflation)
✅ Tech (Base64, JSON, Dev Suite, IP)
✅ Health (BMI, BMR, TDEE)
✅ Productivity (Timer, Workspace, QR)
⚡️ Fast & Private
🔒 No data leaves your device
💎 100% Free
🔗 Use it now: https://tools.kandz.me
🔖 Bookmark it—you’ll need it later!