ss vs netstat: Modern Network Connection Inspection

netstat is deprecated and slow on systems with many connections. ss provides the same information faster with richer filtering.

Use ss with appropriate filters instead of netstat.

# All listening TCP and UDP ports
ss -tulnp

# Breakdown of flags:
# -t = TCP, -u = UDP, -l = listening, -n = numeric, -p = process

# All established TCP connections
ss -tn state established

# Connections to a specific port
ss -tn dst :443

# Connections from a specific source
ss -tn src 192.168.1.0/24

# Socket statistics summary
ss -s

# Show timer info (retransmit, keepalive)
ss -to

# Unix domain sockets
ss -xl

# netstat equivalents (for reference)
netstat -tulnp    # → ss -tulnp
netstat -an       # → ss -an
netstat -rn       # → ip route show

netstat reads /proc/net which becomes slow with tens of thousands of connections. ss uses the NETLINK socket API to query kernel socket tables directly, which is orders of magnitude faster at scale.