netstat & ss

~12 min · netstat, ss, listening-ports, connections

Level 0Pinger

0 XP0/101 lessons0/12 achievements

0/150 XP to next level150 XP to go0% complete

What's listening, what's connected

netstat (and its modern Linux replacement ss) shows network connections, listening sockets, and routing tables. The two questions you ask it constantly: "what's listening on port X?" and "who is this machine actually talking to right now?" Every "port already in use" or "connection refused" diagnostic starts here.

Reading the output

Each line shows protocol, local address:port, foreign address:port, state. Local 0.0.0.0 = listening on all interfaces. Local 127.0.0.1 = loopback only. Listening sockets show state LISTEN; established connections show ESTABLISHED.

Code

macOS / BSD·bash

# Show everything (TCP and UDP, listening + established)
netstat -an

# Just listening sockets, numeric only
netstat -an | grep LISTEN

# Routing table (we used this in Track 1)
netstat -rn

# macOS doesn't have -p (process info) on netstat
# Use lsof -i for that — next lesson

Linux ss (modern replacement)·bash

# All TCP+UDP listening sockets, numeric, with PIDs
sudo ss -tulnp
# -t  TCP
# -u  UDP
# -l  listening only
# -n  numeric (no DNS)
# -p  process info (PID/program)

# Established connections
ss -tan | head

# Filter for a specific port
ss -tlnp 'sport = :22'

External links

Linux ss manual

Exercise

Run netstat -an | grep LISTEN (macOS) or sudo ss -tulnp (Linux). Read every listening port. Can you account for each one? :22 is SSH, :5000 might be a dev server you forgot about, :631 is CUPS print, :5353 is mDNSResponder. Anything you don't recognize is worth investigating.