netstat and ss (connection listing) in Linux CLI - Step-by-Step Execution

Concept Flow - netstat and ss (connection listing)

Start command: netstat or ss

↓

Read system network info

↓

Filter connections based on options

↓

Format output as table

↓

Display connection list to user

↓

End

The command reads network info, filters connections, formats, and shows them.

Execution Sample

Linux CLI

ss -tuln
netstat -tuln

List all TCP and UDP listening connections without resolving names.

Execution Table

Step	Command Run	Action	Output Example	Notes
1	ss -tuln	Reads TCP/UDP listening sockets	Netid State Recv-Q Send-Q Local Address:Port Peer Address:Port	Shows raw socket info without DNS lookup
2	ss -tuln	Filters only listening sockets	tcp LISTEN 0 128 0.0.0.0:22 0.0.0.0:*	Shows SSH listening on port 22
3	ss -tuln	Formats output as table	udp UNCONN 0 0 127.0.0.53%lo:53 0.0.0.0:*	Shows DNS service listening on localhost
4	netstat -tuln	Reads TCP/UDP listening sockets	Proto Recv-Q Send-Q Local Address Foreign Address State	Older tool, similar output
5	netstat -tuln	Filters listening sockets	tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN	Shows web server listening on port 80
6	netstat -tuln	Formats output	udp 0 0 0.0.0.0:123 0.0.0.0:*	Shows NTP service listening
7	End	Display complete list	Full list of active listening connections	User sees all open ports and protocols

💡 All listening connections displayed; command ends.

Variable Tracker

Variable	Start	After 1	After 2	After 3	Final
Command	none	ss -tuln	ss -tuln	netstat -tuln	netstat -tuln
Connections List	empty	raw socket info	filtered listening sockets	raw socket info	filtered listening sockets
Output Format	none	table format	table format	table format	table format

Key Moments - 3 Insights

Why do ss and netstat show different column names but similar info?

Both read network info but format output differently; see execution_table rows 1-3 vs 4-6.

Why use -n option in these commands?

-n avoids resolving IPs to names, making output faster and clearer; shown in all rows.

What does the 'LISTEN' or 'UNCONN' state mean in output?

'LISTEN' means socket waits for connections; 'UNCONN' means UDP socket not connected; see rows 2 and 3.

Visual Quiz - 3 Questions

Look at the execution_table row 2, what does the 'tcp LISTEN 0 128 0.0.0.0:22' line represent?

A A UDP socket sending data on port 22

B A TCP socket listening on port 22 for any IP

C A closed TCP connection on port 22

D A TCP socket connected to port 22

💡 Hint

Check the 'State' column and 'Local Address:Port' in row 2.

At which step does netstat filter only listening sockets?

A Step 1

B Step 4

C Step 5

D Step 7

💡 Hint

Look for 'Filters listening sockets' action in execution_table.

If you remove the -n option, how would the output change?

A IP addresses would be replaced by hostnames

B Output would show more connections

C Output would be empty

D Output would show only UDP connections

💡 Hint

The -n option disables name resolution; see key_moments about -n.

Concept Snapshot

netstat and ss list network connections
Use -tuln to show TCP/UDP listening sockets without names
ss is newer and faster; netstat is older
-n disables name resolution for speed
Output shows protocol, state, local address, and port
Useful to check open ports and services

Full Transcript

This visual guide shows how the Linux commands netstat and ss list network connections. Both commands read system network info, filter for listening TCP and UDP sockets, format the output as a table, and display it. The example commands 'ss -tuln' and 'netstat -tuln' show all listening TCP and UDP ports without resolving IP addresses to names. The execution table traces each step: reading sockets, filtering listening ones, formatting output, and displaying it. Variables track the command used, the connections list state, and output format. Key moments clarify why outputs differ, the purpose of the -n option, and meaning of socket states like LISTEN and UNCONN. The quiz tests understanding of output lines, filtering steps, and effects of options. The snapshot summarizes usage and options for quick reference.

Practice

1. What is the primary purpose of the netstat and ss commands in Linux?

easy

A. To list installed software packages

B. To edit network configuration files

C. To monitor CPU usage

D. To display active and listening network connections

Solution

1. Step 1: Understand command purpose

   Both netstat and ss are used to show network connections and ports.

2. Step 2: Identify correct function

   They do not edit files, monitor CPU, or list software; they show network status.

3. Final Answer:

   To display active and listening network connections -> Option D

4. Quick Check:

   Command purpose = Display connections [OK]

Hint: Remember: netstat and ss show network connections [OK]

Common Mistakes:

• Confusing netstat/ss with file editors
• Thinking they monitor CPU or memory
• Assuming they list installed software

2. Which of the following is the correct syntax to list all listening TCP and UDP ports using ss?

easy

A. ss -tuln

B. ss -a

C. ss --listening

D. ss -x

Solution

1. Step 1: Understand option meanings

   The options -tuln mean TCP (-t), UDP (-u), Listening (-l), Numeric (-n).

2. Step 2: Match options to goal

   To list listening TCP and UDP ports, ss -tuln is the correct syntax.

3. Final Answer:

   ss -tuln -> Option A

4. Quick Check:

   Listening TCP/UDP = ss -tuln [OK]

Hint: Use -tuln with ss to see listening TCP/UDP ports [OK]

Common Mistakes:

• Using -a shows all but not filtered to listening
• Assuming --listening is a valid option
• Using -x which is for Unix sockets, not TCP/UDP

3. What will be the output of the command netstat -tuln | grep ':22' if the SSH service is running and listening on port 22?

medium

A. No output, because port 22 is not shown

B. An error message about invalid syntax

C. A line showing TCP port 22 in LISTEN state

D. A list of all UDP ports except 22

Solution

1. Step 1: Understand command components

   netstat -tuln lists TCP and UDP ports numerically and listening; grep ':22' filters lines with ':22'.

2. Step 2: Interpret output if SSH runs

   If SSH listens on port 22, output will include a line showing TCP port 22 in LISTEN state.

3. Final Answer:

   A line showing TCP port 22 in LISTEN state -> Option C

4. Quick Check:

   SSH on port 22 = netstat output with :22 line [OK]

Hint: grep ':22' filters netstat output for SSH port [OK]

Common Mistakes:

• Expecting no output if port is open
• Thinking command syntax is invalid
• Confusing UDP ports with TCP port 22

4. You run ss -tuln but get no output. What is the most likely reason?

medium

A. The system has no active or listening TCP/UDP ports

B. The command syntax is incorrect

C. No network interfaces are active

D. You forgot to run the command as root or with sudo

Solution

1. Step 1: Check command correctness

   ss -tuln syntax is correct and should show listening ports if any exist.

2. Step 2: Consider system state

   The most likely reason for no output is no TCP/UDP ports are listening, common in minimal containers or systems without bound services. Permissions are not required for ss -tuln.

3. Final Answer:

   The system has no active or listening TCP/UDP ports -> Option A

4. Quick Check:

   No output = no listening TCP/UDP [OK]

Hint: No ss -tuln output means no listening TCP/UDP ports [OK]

Common Mistakes:

• Assuming syntax error when command is correct
• Thinking no active interfaces means no output
• Thinking need root or sudo

5. You want to write a script that checks if port 80 is listening using ss. Which command correctly returns a non-empty output only if port 80 is listening?

hard

A. ss -tuln | grep ':80$'

B. ss -tuln | grep ':80 '

C. ss -tuln | grep ':80'

D. ss -tuln | grep '80'

Solution

1. Step 1: Understand port matching in grep

   Port 80 appears as IP:80[spaces] in ss output before peer address.

2. Step 2: Compare options

   ':80 ' matches exactly :80 (port 80 + space), avoids partial matches like :8080. ':80$' fails (not end-of-line). ':80' and '80' match substrings.

3. Final Answer:

   ss -tuln | grep ':80 ' -> Option B

4. Quick Check:

   Exact port match with ':80 ' [OK]

Hint: Use grep ':80 ' to match port 80 exactly [OK]

Common Mistakes:

• Using grep ':80$' misses because port not at line end
• Using grep ':80' matches ports like 8080
• Using grep '80' matches unrelated numbers