The legacy netstat tool displays sockets, routes, and interface statistics. On modern Linux, ss is the preferred socket-inspection tool because it exposes kernel socket state efficiently and is maintained with iproute2.
Troubleshooting · Lesson 4
netstat
Learn how to inspect Linux sockets, listeners, queues, and TCP states with ss.
Listing Listening Sockets
Show listening TCP and UDP sockets numerically, including owning processes when permitted:
$ sudo ss -lntup
-l selects listeners, -n avoids name lookup, -t and -u select TCP and UDP, and -p requests process data. UDP is connectionless, so its unconnected bound sockets do not have TCP-style LISTEN handshakes.
Why use -n during socket troubleshooting?
Ports, Endpoints, and Services
A local socket endpoint combines an address, transport protocol, and port. A TCP connection is distinguished by protocol plus source and destination addresses and ports. /etc/services maps conventional names to numbers, but it does not prove which process currently owns a port or which application protocol it speaks.
What does an /etc/services entry such as https 443/tcp establish?
Reading TCP States
Common states include:
SYN-SENT: the local endpoint sent a connection request and awaits progress.ESTAB: the TCP connection is established.CLOSE-WAIT: the peer closed its sending side, but the local application has not closed its socket.TIME-WAIT: the endpoint that actively closed waits so delayed segments expire and the final exchange can be handled safely.
Large or growing CLOSE-WAIT populations often point to local application cleanup behavior. TIME-WAIT is a normal protocol state; quantity and resource impact determine whether it is operationally concerning.
Which side still needs to close a socket in CLOSE-WAIT?
Interpreting Queues
Recv-Q and Send-Q meanings depend on state and protocol. On established TCP sockets they can indicate data queued for application receipt or transmission acknowledgement. On listening sockets, queue fields describe connection backlog state rather than application payload bytes in the same way.
One snapshot cannot establish a leak or bottleneck. Sample over time and correlate with process behavior, application latency, retransmissions, and resource limits.
Why is one large socket queue snapshot insufficient for diagnosis?
Filtering an Investigation
Limit output to the protocol, state, endpoint, or process in question:
$ ss -tn state established
$ ss -ltn 'sport = :443'
A listener proves local transport readiness, not remote reachability or application health. Follow with route, firewall, packet, TLS, and application tests appropriate to the symptom.
What does a TCP listener on port 443 fail to prove?
Lesson complete
You finished netstat
You can now use ss to inspect socket state without confusing ports with applications.
List listeners numerically with process context.
Distinguish conventional service names from runtime ownership.
Interpret TCP close states from the local endpoint's perspective.
Sample queues over time with workload context.
Verify remote application behavior beyond a local listener.
Keep your learning progress
Create a free account to save this lesson and continue learning on any device.
Create a free account