netstat and ss (connection listing) in Linux CLI - Practice Problems & Coding Challenges

Challenge - 5 Problems

💻 Command Output

intermediate

What is the output of this ss command?

You run the command ss -tuln on a Linux system. What does this command show?

Linux CLI

ss -tuln

A Lists all TCP and UDP sockets that are listening, showing numeric addresses and ports.

B Lists all established TCP connections only, resolving hostnames.

C Shows all UDP sockets including those in TIME_WAIT state.

D Displays all network interfaces and their IP addresses.

💡 Hint

Look at the flags: -t (TCP), -u (UDP), -l (listening), -n (numeric).

The ss -tuln command lists all listening TCP and UDP sockets with numeric addresses and ports. It does not show established connections or resolve hostnames.

💻 Command Output

intermediate

What is the output of this netstat command?

You run netstat -an | grep ESTABLISHED. What does this command output?

Linux CLI

netstat -an | grep ESTABLISHED

A Lists all active TCP connections that are currently established, showing numeric addresses.

B Lists all UDP sockets that are listening.

C Shows routing table entries with established routes.

D Displays all network interfaces and their MAC addresses.

💡 Hint

The -a flag shows all sockets, -n numeric addresses, and grep ESTABLISHED filters connections in established state.

The command lists all TCP connections that are currently established, showing numeric IP addresses and ports.

📝 Syntax

advanced

Which ss command syntax correctly shows all UDP sockets including listening and non-listening?

Choose the correct ss command to list all UDP sockets, both listening and non-listening.

A ss -t -a

B ss -l -u

C ss -u -a

D ss -a -t

💡 Hint

The -u flag is for UDP, -a shows all sockets.

ss -u -a lists all UDP sockets including listening and non-listening. Other options either show TCP sockets or only listening sockets.

🔧 Debug

advanced

Why does this netstat command fail with an error?

You run netstat -ltupn and get an error: "netstat: option requires an argument -- 'p'". What is wrong?

Linux CLI

netstat -ltupn

A The <code>-p</code> option is deprecated and not supported in this netstat version.

B The <code>-p</code> option is missing a value; it requires a protocol name after it.

C The options are in wrong order; <code>-p</code> must come before <code>-n</code>.

D The <code>-p</code> option requires root privileges to show process info; running as normal user causes error.

💡 Hint

Check if you have permission to use -p option.

The -p option shows process info but requires root privileges. Running as a normal user causes this error.

🚀 Application

expert

How many TCP connections are in the LISTEN state after running this command?

You run ss -tn state LISTEN on a server. The output shows these lines:

LISTEN 0      128          0.0.0.0:22        0.0.0.0:*
LISTEN 0      100          [::]:80           [::]:*

How many TCP connections are in the LISTEN state?

Linux CLI

ss -tn state LISTEN

A 0

B 2

C 1

D 128

💡 Hint

Count the number of LISTEN lines in the output.

There are two lines showing TCP sockets in LISTEN state, so the count is 2.

Practice

1. What is the primary purpose of the netstat and ss commands in Linux?

easy

A. To list installed software packages

B. To edit network configuration files

C. To monitor CPU usage

D. To display active and listening network connections

Solution

1. Step 1: Understand command purpose

   Both netstat and ss are used to show network connections and ports.

2. Step 2: Identify correct function

   They do not edit files, monitor CPU, or list software; they show network status.

3. Final Answer:

   To display active and listening network connections -> Option D

4. Quick Check:

   Command purpose = Display connections [OK]

Hint: Remember: netstat and ss show network connections [OK]

Common Mistakes:

• Confusing netstat/ss with file editors
• Thinking they monitor CPU or memory
• Assuming they list installed software

2. Which of the following is the correct syntax to list all listening TCP and UDP ports using ss?

easy

A. ss -tuln

B. ss -a

C. ss --listening

D. ss -x

Solution

1. Step 1: Understand option meanings

   The options -tuln mean TCP (-t), UDP (-u), Listening (-l), Numeric (-n).

2. Step 2: Match options to goal

   To list listening TCP and UDP ports, ss -tuln is the correct syntax.

3. Final Answer:

   ss -tuln -> Option A

4. Quick Check:

   Listening TCP/UDP = ss -tuln [OK]

Hint: Use -tuln with ss to see listening TCP/UDP ports [OK]

Common Mistakes:

• Using -a shows all but not filtered to listening
• Assuming --listening is a valid option
• Using -x which is for Unix sockets, not TCP/UDP

3. What will be the output of the command netstat -tuln | grep ':22' if the SSH service is running and listening on port 22?

medium

A. No output, because port 22 is not shown

B. An error message about invalid syntax

C. A line showing TCP port 22 in LISTEN state

D. A list of all UDP ports except 22

Solution

1. Step 1: Understand command components

   netstat -tuln lists TCP and UDP ports numerically and listening; grep ':22' filters lines with ':22'.

2. Step 2: Interpret output if SSH runs

   If SSH listens on port 22, output will include a line showing TCP port 22 in LISTEN state.

3. Final Answer:

   A line showing TCP port 22 in LISTEN state -> Option C

4. Quick Check:

   SSH on port 22 = netstat output with :22 line [OK]

Hint: grep ':22' filters netstat output for SSH port [OK]

Common Mistakes:

• Expecting no output if port is open
• Thinking command syntax is invalid
• Confusing UDP ports with TCP port 22

4. You run ss -tuln but get no output. What is the most likely reason?

medium

A. The system has no active or listening TCP/UDP ports

B. The command syntax is incorrect

C. No network interfaces are active

D. You forgot to run the command as root or with sudo

Solution

1. Step 1: Check command correctness

   ss -tuln syntax is correct and should show listening ports if any exist.

2. Step 2: Consider system state

   The most likely reason for no output is no TCP/UDP ports are listening, common in minimal containers or systems without bound services. Permissions are not required for ss -tuln.

3. Final Answer:

   The system has no active or listening TCP/UDP ports -> Option A

4. Quick Check:

   No output = no listening TCP/UDP [OK]

Hint: No ss -tuln output means no listening TCP/UDP ports [OK]

Common Mistakes:

• Assuming syntax error when command is correct
• Thinking no active interfaces means no output
• Thinking need root or sudo

5. You want to write a script that checks if port 80 is listening using ss. Which command correctly returns a non-empty output only if port 80 is listening?

hard

A. ss -tuln | grep ':80$'

B. ss -tuln | grep ':80 '

C. ss -tuln | grep ':80'

D. ss -tuln | grep '80'

Solution

1. Step 1: Understand port matching in grep

   Port 80 appears as IP:80[spaces] in ss output before peer address.

2. Step 2: Compare options

   ':80 ' matches exactly :80 (port 80 + space), avoids partial matches like :8080. ':80$' fails (not end-of-line). ':80' and '80' match substrings.

3. Final Answer:

   ss -tuln | grep ':80 ' -> Option B

4. Quick Check:

   Exact port match with ':80 ' [OK]

Hint: Use grep ':80 ' to match port 80 exactly [OK]

Common Mistakes:

• Using grep ':80$' misses because port not at line end
• Using grep ':80' matches ports like 8080
• Using grep '80' matches unrelated numbers