Command by command
| Legacy Linux (net-tools) | Linux | What it gives you |
|---|---|---|
netstat -tulpn | ss -tulpn | Listening TCP and UDP sockets with process names |
netstat -an | ss -an | All sockets, numeric |
netstat -tn | ss -tn | Established TCP connections |
netstat -r | ip route show | Routing table moved to iproute2 |
netstat -i | ip -s link show | Per-interface counters |
What the output looks like
$ ss -tulpn
Netid State Recv-Q Send-Q Local Address:Port Peer Address:Port Process
tcp LISTEN 0 5 0.0.0.0:80 0.0.0.0:* users:(("socat",pid=2817,fd=5))Why the two differ
netstat works by opening and parsing files under /proc/net/. On a host with tens of thousands of sockets that means reading and text-parsing a very large amount of data on every invocation, which is why it can take seconds to return. ss asks the kernel directly over a netlink socket and can ask it to filter server-side, so it returns almost immediately and can express filters netstat has no syntax for, such as ss state established '( dport = :443 )'.
The trap
netstat -r has no ss equivalent, and people looking for one waste time. Routing moved to a different tool entirely: use ip route show. ss deals only with sockets.
Common questions
Do I need root for ss -p?
To see process names for sockets you do not own, yes. Without privileges ss -p silently omits the process column for other users' sockets rather than erroring, which makes it look as though nothing is listening.
What replaced netstat -s for protocol statistics?
ss -s gives a short socket summary, but for the full per-protocol counters netstat printed, use nstat or read /proc/net/snmp directly.
Stop reading, start running
Open the lab, go live, and run ss -tulpn against real Linux networking in your browser. No install, no signup.