netstat and ss (connection listing) in Linux CLI - Step-by-Step Execution

Concept Flow - netstat and ss (connection listing)

Start command: netstat or ss

↓

Read system network info

↓

Filter connections based on options

↓

Format output as table

↓

Display connection list to user

↓

End

The command reads network info, filters connections, formats, and shows them.

Execution Sample

Linux CLI

ss -tuln
netstat -tuln

List all TCP and UDP listening connections without resolving names.

Execution Table

Step	Command Run	Action	Output Example	Notes
1	ss -tuln	Reads TCP/UDP listening sockets	Netid State Recv-Q Send-Q Local Address:Port Peer Address:Port	Shows raw socket info without DNS lookup
2	ss -tuln	Filters only listening sockets	tcp LISTEN 0 128 0.0.0.0:22 0.0.0.0:*	Shows SSH listening on port 22
3	ss -tuln	Formats output as table	udp UNCONN 0 0 127.0.0.53%lo:53 0.0.0.0:*	Shows DNS service listening on localhost
4	netstat -tuln	Reads TCP/UDP listening sockets	Proto Recv-Q Send-Q Local Address Foreign Address State	Older tool, similar output
5	netstat -tuln	Filters listening sockets	tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN	Shows web server listening on port 80
6	netstat -tuln	Formats output	udp 0 0 0.0.0.0:123 0.0.0.0:*	Shows NTP service listening
7	End	Display complete list	Full list of active listening connections	User sees all open ports and protocols

💡 All listening connections displayed; command ends.

Variable Tracker

Variable	Start	After 1	After 2	After 3	Final
Command	none	ss -tuln	ss -tuln	netstat -tuln	netstat -tuln
Connections List	empty	raw socket info	filtered listening sockets	raw socket info	filtered listening sockets
Output Format	none	table format	table format	table format	table format

Key Moments - 3 Insights

Why do ss and netstat show different column names but similar info?

Both read network info but format output differently; see execution_table rows 1-3 vs 4-6.

Why use -n option in these commands?

-n avoids resolving IPs to names, making output faster and clearer; shown in all rows.

What does the 'LISTEN' or 'UNCONN' state mean in output?

'LISTEN' means socket waits for connections; 'UNCONN' means UDP socket not connected; see rows 2 and 3.

Visual Quiz - 3 Questions

Look at the execution_table row 2, what does the 'tcp LISTEN 0 128 0.0.0.0:22' line represent?

A A UDP socket sending data on port 22

B A TCP socket listening on port 22 for any IP

C A closed TCP connection on port 22

D A TCP socket connected to port 22

💡 Hint

Check the 'State' column and 'Local Address:Port' in row 2.

At which step does netstat filter only listening sockets?

A Step 1

B Step 4

C Step 5

D Step 7

💡 Hint

Look for 'Filters listening sockets' action in execution_table.

If you remove the -n option, how would the output change?

A IP addresses would be replaced by hostnames

B Output would show more connections

C Output would be empty

D Output would show only UDP connections

💡 Hint

The -n option disables name resolution; see key_moments about -n.

Concept Snapshot

netstat and ss list network connections
Use -tuln to show TCP/UDP listening sockets without names
ss is newer and faster; netstat is older
-n disables name resolution for speed
Output shows protocol, state, local address, and port
Useful to check open ports and services

Full Transcript

This visual guide shows how the Linux commands netstat and ss list network connections. Both commands read system network info, filter for listening TCP and UDP sockets, format the output as a table, and display it. The example commands 'ss -tuln' and 'netstat -tuln' show all listening TCP and UDP ports without resolving IP addresses to names. The execution table traces each step: reading sockets, filtering listening ones, formatting output, and displaying it. Variables track the command used, the connections list state, and output format. Key moments clarify why outputs differ, the purpose of the -n option, and meaning of socket states like LISTEN and UNCONN. The quiz tests understanding of output lines, filtering steps, and effects of options. The snapshot summarizes usage and options for quick reference.