TCP Connection Troubleshooting with netstat and ss

Application connections hang, time out, or fail intermittently but the service appears to be running.

Systematic TCP debugging:

# Check listening ports (ss is modern replacement for netstat)
ss -tlnp  # TCP listening, numeric, show process
ss -tunap # TCP+UDP, all states, numeric, show process

# Check connection states
ss -t state established
ss -t state time-wait | wc -l  # Too many TIME_WAIT?
ss -t state close-wait | wc -l  # Leaked connections?

# Connection to specific port
ss -t dst :5432  # All connections to PostgreSQL

# Check for port conflicts
ss -tlnp | grep :8080

# Test connectivity
nc -zv host 5432 -w 3  # TCP connect test with 3s timeout
curl -v telnet://host:5432  # Alternative connect test

# DNS resolution check
dig +short hostname A
host hostname

# Trace route to find where packets drop
traceroute -T -p 443 host  # TCP traceroute
mtr --tcp -P 443 host       # Continuous trace

# Check firewall rules
iptables -L -n | grep 5432

Common states to watch:

• CLOSE_WAIT piling up: application not closing connections
• TIME_WAIT flood: too many short-lived connections (enable SO_REUSEADDR)
• SYN_SENT stuck: firewall blocking or host unreachable

TCP connection issues manifest as timeouts and hangs. Understanding connection states reveals whether the problem is at the network, firewall, or application layer.

Debugging network connectivity issues