netstat

The legacy netstat tool displays sockets, routes, and interface statistics. On modern Linux, ss is the preferred socket-inspection tool because it exposes kernel socket state efficiently and is maintained with iproute2.

Listing Listening Sockets

Show listening TCP and UDP sockets numerically, including owning processes when permitted:

$ sudo ss -lntup

-l selects listeners, -n avoids name lookup, -t and -u select TCP and UDP, and -p requests process data. UDP is connectionless, so its unconnected bound sockets do not have TCP-style LISTEN handshakes.

CheckWhy use -n during socket troubleshooting?

It creates a new network namespace. It prevents address and port name lookups. It closes every non-listening socket.

Ports, Endpoints, and Services

A local socket endpoint combines an address, transport protocol, and port. A TCP connection is distinguished by protocol plus source and destination addresses and ports. /etc/services maps conventional names to numbers, but it does not prove which process currently owns a port or which application protocol it speaks.

CheckWhat does an /etc/services entry such as https 443/tcp establish?

That a healthy HTTPS server is currently listening. The conventional service-name mapping for that port. That all port 443 traffic is encrypted correctly.

Reading TCP States

Common states include:

• SYN-SENT: the local endpoint sent a connection request and awaits progress.
• ESTAB: the TCP connection is established.
• CLOSE-WAIT: the peer closed its sending side, but the local application has not closed its socket.
• TIME-WAIT: the endpoint that actively closed waits so delayed segments expire and the final exchange can be handled safely.

Large or growing CLOSE-WAIT populations often point to local application cleanup behavior. TIME-WAIT is a normal protocol state; quantity and resource impact determine whether it is operationally concerning.

CheckWhich side still needs to close a socket in CLOSE-WAIT?

Every router on the Internet. The DNS authoritative server. The local application.

Interpreting Queues

Recv-Q and Send-Q meanings depend on state and protocol. On established TCP sockets they can indicate data queued for application receipt or transmission acknowledgement. On listening sockets, queue fields describe connection backlog state rather than application payload bytes in the same way.

One snapshot cannot establish a leak or bottleneck. Sample over time and correlate with process behavior, application latency, retransmissions, and resource limits.

CheckWhy is one large socket queue snapshot insufficient for diagnosis?

Linux never stores data in socket queues. Every queue value is a filesystem permission. Queue impact needs state, trends, and workload context.

Filtering an Investigation

Limit output to the protocol, state, endpoint, or process in question:

$ ss -tn state established
$ ss -ltn 'sport = :443'

A listener proves local transport readiness, not remote reachability or application health. Follow with route, firewall, packet, TLS, and application tests appropriate to the symptom.

CheckWhat does a TCP listener on port 443 fail to prove?

That a local socket accepted a bind and listen operation. That remote clients can complete a valid HTTPS request. That TCP has a numeric port field.

Summary

You can now use ss to inspect socket state without confusing ports with applications.

1. List listeners numerically with process context.
2. Distinguish conventional service names from runtime ownership.
3. Interpret TCP close states from the local endpoint's perspective.
4. Sample queues over time with workload context.
5. Verify remote application behavior beyond a local listener.