netstat

The legacy netstat tool displays sockets, routes, and interface statistics. On modern Linux, ss is the preferred socket-inspection tool because it exposes kernel socket state efficiently and is maintained with iproute2.

Listing Listening Sockets

Show listening TCP and UDP sockets numerically, including owning processes when permitted:

$ sudo ss -lntup

-l selects listeners, -n avoids name lookup, -t and -u select TCP and UDP, and -p requests process data. UDP is connectionless, so its unconnected bound sockets do not have TCP-style LISTEN handshakes.

Ports, Endpoints, and Services

A local socket endpoint combines an address, transport protocol, and port. A TCP connection is distinguished by protocol plus source and destination addresses and ports. /etc/services maps conventional names to numbers, but it does not prove which process currently owns a port or which application protocol it speaks.

Reading TCP States

Common states include:

• SYN-SENT: the local endpoint sent a connection request and awaits progress.
• ESTAB: the TCP connection is established.
• CLOSE-WAIT: the peer closed its sending side, but the local application has not closed its socket.
• TIME-WAIT: the endpoint that actively closed waits so delayed segments expire and the final exchange can be handled safely.

Large or growing CLOSE-WAIT populations often point to local application cleanup behavior. TIME-WAIT is a normal protocol state; quantity and resource impact determine whether it is operationally concerning.

Interpreting Queues

Recv-Q and Send-Q meanings depend on state and protocol. On established TCP sockets they can indicate data queued for application receipt or transmission acknowledgement. On listening sockets, queue fields describe connection backlog state rather than application payload bytes in the same way.

One snapshot cannot establish a leak or bottleneck. Sample over time and correlate with process behavior, application latency, retransmissions, and resource limits.

Filtering an Investigation

Limit output to the protocol, state, endpoint, or process in question:

$ ss -tn state established
$ ss -ltn 'sport = :443'

A listener proves local transport readiness, not remote reachability or application health. Follow with route, firewall, packet, TLS, and application tests appropriate to the symptom.

Summary

You can now use ss to inspect socket state without confusing ports with applications.

1. List listeners numerically with process context.
2. Distinguish conventional service names from runtime ownership.
3. Interpret TCP close states from the local endpoint's perspective.
4. Sample queues over time with workload context.
5. Verify remote application behavior beyond a local listener.