ss tool - alternative to netstat

jenkins@ubuntu:~/.ssh$ ss -4 state listening
Netid Recv-Q Send-Q                           Local Address:Port                                            Peer Address:Port               
tcp   0      5                                    127.0.0.1:ipp                                                        *:*                    
tcp   0      50                                           *:39103                                                      *:*                    
tcp   0      1                                    127.0.0.1:32000                                                      *:*                    
tcp   0      50                                           *:9092                                                       *:*                    
tcp   0      50                                           *:44709                                                      *:*                    
tcp   0      128                                  127.0.0.1:4040                                                       *:*                    
tcp   0      25                                           *:9000                                                       *:*                    
tcp   0      50                                           *:45928                                                      *:*                    
tcp   0      128                                  127.0.0.1:4041                                                       *:*                    
tcp   0      50                                   127.0.0.1:9001                                                       *:*                    
tcp   0      50                                   127.0.0.1:38576                                                      *:*                    
tcp   0      5                                    127.0.1.1:domain                                                     *:*                   
jenkins@ubuntu:~/.ssh$

ss dst 192.168.1.139

With this knowledge, let's take a look at how we replicate the following netstat command:

[root@web01][01:29:57 PM][~]$ netstat -tlp

This command specifically is looking at TCP Listening Sockets, and listing the PID of the process utilizing the socket.  To get the same output out of ss, we would do the following:

[root@web01][01:29:57 PM][~]$ ss -tlp

You'll notice some distinct similarities here.  The only change is the name of the application we call with our shell.  The output is where things really get different.

[root@web01][01:29:57 PM][~]$ ss -tlp
State Recv-Q Send-Q Local Address:Port Peer Address:Port
LISTEN 0 128 *:memcache *:* users:(("memcached",pid=61424,fd=46))
LISTEN 0 128 *:ssh *:* users:(("sshd",pid=1672,fd=3))
LISTEN 0 100 127.0.0.1:smtp *:* users:(("master",pid=2337,fd=13))
LISTEN 0 128 127.0.0.1:smux *:* users:(("snmpd",pid=12442,fd=9))
("httpd",pid=24482,fd=4),("httpd",pid=19878,fd=4),("httpd",pid=7387,fd=4),("httpd",pid=7353,fd=4))
LISTEN 0 128 :::ssh :::* users:(("sshd",pid=1672,fd=4))
LISTEN 0 100 ::1:smtp :::* users:(("master",pid=2337,fd=14))
LISTEN 0 128 :::https :::* users:(("httpd",pid=60105,fd=6),("httpd",pid=60096,fd=6),("httpd",pid=47756,fd=6),("httpd",pid=45510,fd=6),("httpd",pid=44321,fd=6),("httpd",pid=35662,fd=6),("httpd",pid=31465,fd=6),("httpd",pid=24482,fd=6),("httpd",pid=19878,fd=6),("httpd",pid=7387,fd=6),("httpd",pid=7353,fd=6))

As you can see, this specific server is listening on both port 80 (http above) and port 443 (https above).  The huge difference comes with the fact that we are able to gather additional information regarding FD (file descriptors), individual PID's for each Apache process, and a local send/receive-Q status.  These may assist further in diagnostic work you may undertake.

So as to provide additional examples;

If you would like to view ALL listening sockets, you would type:

[root@web01][01:30:00 PM][~]$ ss -s

To display ALL open network ports, you would type:

[root@web01][01:40:36 PM][~]$ ss -l

To filter by connection state, for example if you wanted to see all connected HTTP sockets, you would type:

[root@web01][01:52:14 PM][~]$ ss -o state established '( dport = :http )'

Where :http in the example above is the name of the process for which you want to see established process statistics, and dport stands for destination port.  You can choose to change 'dport' in the above example to 'sport', if you're looking for outbound http connections