Modern Linux systems have completely replaced legacy utilities like netstat and route in favor of the high-performance iproute2 suite and the ss (Socket Statistics) command. Because ss reads network metrics directly from kernel netlink interfaces rather than parsing virtual files in /proc/net, it delivers near-instantaneous output even on high-throughput servers handling tens of thousands of concurrent TCP sockets.
Inspecting Listening Ports and Active Sockets with ss
The ss command provides versatile filtering flags to audit which daemons are listening on system ports and inspect active transport-layer connections:
# Display all listening TCP and UDP sockets with process identifiers
sudo ss -tulpn
# Display all established TCP sockets
ss -t -a state established| Command Option | Functional Behavior | Diagnostic Value |
|---|---|---|
-t / -u |
Filters strictly for TCP or UDP protocols. | Isolates specific transport layers during network audits. |
-l |
Filters for listening sockets awaiting connections. | Identifies exposed server daemons and service bindings. |
-p |
Displays the process name and PID holding the socket. | Pinpoints which application owns an open port (requires root). |
-n |
Prevents DNS hostname and service port resolution. | Speeds up execution and prevents DNS lookup hang delays. |
-i |
Outputs internal TCP metrics (RTT, congestion window). | Diagnoses packet loss, retransmissions, and throughput bottlenecks. |
Advanced Socket State and Port Filtering
Unlike legacy tools, ss supports expression-based filtering, allowing system administrators to isolate specific remote IP addresses, ports, or TCP states without piping output to grep or awk:
# Show sockets connected to HTTPS port 443
ss -t '( dport = :https or sport = :https )'
# Display sockets stuck in TIME-WAIT or CLOSE-WAIT states
ss -t state time-wait
ss -t state close-wait
# Filter for connections from a specific client subnet
ss -t dst 192.168.1.0/24Managing Network Links and Interfaces with ip link and ip addr
The ip command consolidates all interface, addressing, and routing controls under a unified modular syntax. To inspect interface status and assign IP configurations:
# Display link-layer status and MAC addresses
ip -s link show
# Display assigned IPv4 and IPv6 addresses
ip -br addr show
# Temporarily bring up or take down an interface
sudo ip link set dev eth0 down
sudo ip link set dev eth0 up
# Assign an auxiliary IP address to an interface
sudo ip addr add 192.168.1.150/24 dev eth0Auditing and Configuring Routing Tables with ip route
The kernel routing table dictates how outbound packets traverse local subnets and internet gateways. Inspecting and modifying routes via ip route ensures accurate packet forwarding:
# Display the active default routing table
ip route show
# Identify which interface and route the kernel selects for a destination IP
ip route get 8.8.8.8
# Add a static route for an internal enterprise subnet
sudo ip route add 10.50.0.0/16 via 192.168.1.254 dev eth0
# Remove an obsolete static route
sudo ip route del 10.50.0.0/16Mastering both ss and ip equips Linux engineers with the foundational tools required to troubleshoot connection drops, identify rogue listening services, and resolve complex multi-homed network topology conflicts.