Netstat vs SS: Linux Network Monitoring Guide

This article provides an overview of network monitoring in Linux, focusing on the legacy netstat utility and its modern replacement, ss. You will learn the historical purpose of netstat, the performance limitations that led to its deprecation, how the ss command improves upon its predecessor, and the standard syntax used to inspect sockets, ports, and network statistics in modern environments.

The Purpose of the Netstat Command

The netstat (network statistics) command is a classic command-line tool that was part of the Linux net-tools package. For decades, administrators relied on it to inspect incoming and outgoing network connections, view routing tables, check interface statistics, and determine which network services were bound to specific ports.

Key functions of netstat include:

• Displaying active TCP and UDP connections.
• Identifying listening ports waiting for incoming connections.
• Viewing network interface metrics to monitor packet transmission and errors.
• Displaying the kernel routing table.

Despite its wide adoption, netstat became obsolete due to how it gathers data. It reads from the /proc/net virtual filesystem, which requires parsing text files. On modern high-traffic servers with thousands of concurrent connections, this mechanism causes noticeable performance slowdowns and high CPU overhead. As a result, the net-tools suite was officially deprecated.

The Modern Replacement: The SS Command

The ss (socket statistics) command is the modern alternative to netstat, included in the standard iproute2 package across modern Linux distributions.

Unlike netstat, ss communicates directly with the Linux kernel space using the Netlink protocol. This architecture enables ss to retrieve network socket information significantly faster, using substantially less memory and CPU processing. It is designed to handle systems maintaining tens of thousands of open connections without lagging or crashing the terminal session.

Key advantages of ss over netstat:

• Performance: Direct kernel queries via Netlink instead of parsing /proc files.
• Detailed Socket Information: Deeper visibility into TCP states, internal TCP metrics, and socket memory usage.
• Advanced Filtering: Native support for filtering results by state, port, and IP address without relying on external utilities like grep.

Common Command Equivalents

Because ss was designed to replace netstat, it shares many of the same command-line flags, making the transition straightforward.

• List all listening TCP and UDP ports:
  • netstat -tuln
  • ss -tuln
• Show listening ports with process names/PIDs:
  • netstat -tulnp
  • ss -tulnp
• Display all active and established connections:
  • netstat -at
  • ss -t
• Display socket summary statistics:
  • netstat -s
  • ss -s

Advanced Filtering with SS

While netstat usually requires piping output to tools like grep or awk, ss includes built-in expression filters.

• Filter by state:
  Display only established connections:

  ss -t state established

• Filter by port:
  Display all sockets connected to port 443 (HTTPS):

  ss -t '( dport = :443 or sport = :443 )'

• Filter by destination address:
  Display connections to a specific IP:

  ss -t dst 192.168.1.50

While netstat remains functional on legacy platforms, ss is the modern standard for Linux network diagnostics, offering greater speed, lower system resource utilization, and superior filtering capabilities.