How to Use netstat and ss to Monitor Network Connections and Ports

Network monitoring is a crucial aspect of system administration, security, and troubleshooting in Linux environments. Whether you’re a server administrator, a developer, or simply curious about your own computer’s network activity, knowing how to see which services are listening, what connections are active, and which processes are using which ports can give you valuable insight. Two of the most effective tools for this task are netstat and ss. While netstat is the classic utility for examining network state, ss is quickly becoming the preferred choice for modern systems due to its speed and advanced filtering capabilities.

This comprehensive guide explores how to use both netstat and ss to monitor your network connections and ports. You’ll learn about installation, basic and advanced command usage, practical troubleshooting, output interpretation, and best practices for securing your Linux system.

Prerequisites

• Access to a Linux system (Ubuntu, CentOS, Fedora, Debian, or similar)
• Basic familiarity with the Linux command line interface
• Sudo or root privileges for advanced network inspection
• Optional: Familiarity with networking concepts (TCP, UDP, IP addresses, ports, processes)

netstat vs ss: An Overview

netstat (network statistics) is a well-known utility for displaying network connections, routing tables, interface statistics, masquerade connections, and more. However, as Linux distributions have modernized, netstat has been deprecated in favor of ss (socket statistics). The ss tool is part of the iproute2 package, and it provides similar—but often much faster and more detailed—network statistics.

Both tools can:

• Display listening and established connections
• Show which processes are using which ports
• Filter output by protocol, address, or port
• Assist in troubleshooting network issues

While netstat is still available on many systems for legacy compatibility, ss is recommended for most modern Linux environments.

Step 1: Installing netstat and ss (if needed)

Step 1:

netstat is part of the net-tools package, which may not be installed by default on new distributions:

sudo apt update

sudo apt install net-tools

For RHEL/CentOS/Fedora, use:

sudo yum install net-tools

or

sudo dnf install net-tools

Step 2:

ss is included by default in most modern Linux systems as part of the iproute2 package:

ss --version

If not installed, you can add it with:

sudo apt install iproute2

or

sudo yum install iproute

Understanding Network Connections and Ports

Before diving into commands, it’s helpful to understand some key networking concepts:

• TCP and UDP: The two main transport layer protocols. TCP provides reliable, connection-oriented communication. UDP is connectionless and faster but less reliable.
• Ports: Numbers assigned to specific processes or network services on your system. For example, web servers often use port 80 (HTTP) or 443 (HTTPS), while SSH uses port 22.
• Listening Ports: Ports that are open and waiting for incoming connections.
• Established Connections: Active network connections between your system and remote hosts.
• Process IDs (PIDs): Unique identifiers for each running program or service.

Step 2: Basic Usage of netstat

Step 1: List all active and listening TCP and UDP ports:

netstat -tuln

• -t: Display TCP ports
• -u: Display UDP ports
• -l: Show only listening sockets
• -n: Show numerical addresses (don’t resolve hostnames)

Step 2: Show which processes are using which ports:

sudo netstat -tulnp

• -p: Show process ID and program name

Step 3: Display all network connections (including established and listening):

netstat -ant

• -a: Show all sockets

Step 4: Show routing tables:

netstat -r

Step 5: Show network interface statistics:

netstat -i

Example output for netstat -tuln:

Proto Recv-Q Send-Q Local Address           Foreign Address         State
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN
tcp6       0      0 :::80                   :::*                    LISTEN
udp        0      0 0.0.0.0:68              0.0.0.0:*

This output shows which ports are open and on which interfaces.

Step 3: Basic Usage of ss

Step 1: List all listening TCP and UDP ports:

ss -tuln

Step 2: Show all established TCP connections:

ss -tn state established

Step 3: Display sockets with process information:

sudo ss -tulnp

Example output for ss -tuln:

Netid State      Recv-Q Send-Q Local Address:Port  Peer Address:Port
tcp   LISTEN     0      128    0.0.0.0:22         0.0.0.0:*
tcp   LISTEN     0      128    [::]:80            [::]:*

Step 4: Filtering and Advanced Examples

Step 1: Find which process is using a specific port (e.g., 22 for SSH):

sudo netstat -tulnp | grep :22

sudo ss -tulnp | grep :22

Step 2: See only IPv4 or IPv6 sockets:

ss -4 -tuln   

ss -6 -tuln   

Step 3: List all socket statistics and summary:

ss -s

This summarizes all sockets, including TCP and UDP states.

Step 4: Filter by port or address with ss:

ss -tuln 'sport = :80'

ss -tuln 'dport = :22'

This shows sockets where the source port is 80 (web server) or destination port is 22 (SSH).

Step 5: Display UNIX domain sockets (used for local inter-process communication):

ss -x

Step 6: Show connections for a specific process by PID:

ss -p | grep 1234

Replace 1234 with the actual process ID.

Step 5: Monitoring and Live Updates

Step 1: To continually monitor network connections, use the watch command:

watch -n 2 ss -tunap

This refreshes the output every 2 seconds.

Step 2: Combine ss or netstat with grep to track a specific service:

watch 'ss -tunap | grep ssh'

Step 3: For historical connection data, consider using dedicated tools like iftop, nethogs, or tcpdump for deeper packet analysis.

Step 6: Understanding Output Columns

Both netstat and ss display several columns. Here’s what they mean:

• Proto/Netid: Protocol (TCP, UDP, UNIX, etc.)
• Recv-Q/Send-Q: Queue sizes for received and sent data
• Local Address:Port: IP address and port on your system
• Peer Address:Port/Foreign Address: Remote IP and port
• State: Connection state (e.g., LISTEN, ESTABLISHED, TIME-WAIT)
• PID/Program name: (with -p flag) The process that owns the socket

Pay close attention to the STATE column. For example, LISTEN means the port is open and waiting for connections, while ESTABLISHED means there is an active connection.

Step 7: Troubleshooting Common Issues

Step 1: If a port you expect to be open isn’t listed:

• Check if the corresponding service is running (systemctl status servicename).
• Verify that the service is listening on the expected interface and port.
• Use firewall-cmd, ufw, or iptables to check for firewall blocks.

Step 2: If you see unexpected open ports:

• Use the -p flag to see which process owns the port.
• Investigate unknown or suspicious processes for potential security threats.

Step 3: If you need to free up a port:

• Identify and stop the process using that port (sudo kill PID or systemctl stop servicename).

Security and Best Practices

• Regularly monitor open and listening ports to detect unauthorized services.
• Limit listening services to specific network interfaces (for example, bind MySQL only to localhost).
• Keep networking utilities up-to-date and use strong firewall rules to block unnecessary exposure.
• Combine ss and netstat usage with log monitoring and intrusion detection systems (IDS) for robust network security.
• Avoid running unnecessary network services to reduce attack surface.

Step 8: Advanced Usage and Scripting

Step 1: Automate regular network checks by scripting ss or netstat:

#!/bin/bash
ss -tuln > /var/log/daily_ports.log

Schedule this with cron for daily summaries of open ports.

Step 2: Generate human-friendly reports:

ss -tuln | awk '{print $1, $5, $6}' | column -t

Step 3: Use ss with -H (no header) and awk or grep for custom parsing in scripts.

Conclusion

Mastering netstat and ss gives you powerful visibility into your Linux system’s network activity. While netstat remains familiar, ss is the tool of choice for speed and advanced filtering. Both utilities help you pinpoint open ports, investigate suspicious connections, troubleshoot network issues, and improve overall security. Practice using various options to suit your needs, and consider combining them with other network monitoring tools for a comprehensive view of your system’s connectivity.