ss vs netstat: differences and equivalent commands
The commands on this page have not been executed by our verification runner yet.updated
- tool
- ss / netstat
- compares
- ss vs netstat
ss (from iproute2) is the current Linux tool for listing sockets; netstat (from net-tools) is its deprecated predecessor. They show the same kind of information, and most options carry over: netstat -tulpn becomes ss -tulpn. ss reads socket data from the kernel through netlink, so it is faster on machines with many connections, and it has a filter language for states, ports and addresses. Many minimal distributions and container images no longer install netstat at all (netstat: command not found); use ss, or install net-tools if a script requires it.
Side by side
| ss | netstat | |
|---|---|---|
| Package | iproute2 (installed by default on most distributions) | net-tools (deprecated, often not installed) |
| Data source | Netlink (sock_diag), /proc as fallback | Parses /proc/net/* text files |
| Speed with many sockets | Fast | Slow with tens of thousands of sockets |
| Filters | Built in: state, sport, dport, src, dst, with and/or | Only through grep |
| Extra detail | TCP internals with -i (rtt, cwnd, retrans), timers with -o, memory with -m | Timers with -o |
| Other jobs | Sockets only | Also routes (-r), interfaces (-i), multicast (-g): use ip route, ip -s link, ip maddr instead |
Equivalent commands
| Task | netstat | ss / iproute2 |
|---|---|---|
| Listening TCP and UDP ports with process | netstat -tulpn | ss -tulpn |
| All TCP connections, numeric | netstat -tan | ss -tan |
| Established connections only | netstat -tn | grep ESTABLISHED | ss -tn state established |
| Connections to port 443 | netstat -tn | grep ":443 " | ss -tn '( dport = :443 or sport = :443 )' |
| Summary statistics | netstat -s | ss -s (socket totals); nstat for protocol counters |
| Unix domain sockets | netstat -x | ss -x |
| Routing table | netstat -rn | ip route |
| Interface counters | netstat -i | ip -s link |
Output differences to know
- State names are abbreviated in
ss(ESTAB,TIME-WAIT,CLOSE-WAIT) and written in full innetstat(ESTABLISHED,TIME_WAIT). Scripts that grep forESTABLISHEDneed changing. ss -pprintsusers:(("nginx",pid=1234,fd=6));netstat -pprints1234/nginx.- Without
-lor-a,ssshows only non-listening sockets (connections), likenetstatwithout-l/-a. - Both need root to show processes owned by other users.
On macOS and BSD, netstat is still the native tool and ss does not exist; use netstat -anv -p tcp or lsof -nP -iTCP -sTCP:LISTEN.
Sources
Related pages
commands · ssss -tulpn: list listening ports and the process using themss -tulpn lists listening TCP and UDP ports with the owning process on Linux. What each flag means, filters for one port, and macOS and Windows equivalents.cheat sheets · ssss cheat sheet: sockets, ports and connections on Linuxss cheat sheet for Linux: list listening ports with ss -tulpn, filter by state, port or address, count connections, and show processes and TCP internals.codes · ssTCP socket states in ss and netstat: ESTAB, TIME-WAIT, CLOSE-WAIT, SYN-SENT and moreTCP states shown by ss and netstat: LISTEN, ESTAB, TIME-WAIT, CLOSE-WAIT, SYN-SENT, FIN-WAIT. What each means and when large numbers point to a problem.commands · ssss: count TCP connections by state, port or remote IPCount TCP connections with ss: totals with ss -s, by state with awk and uniq, per local port and per remote IP, and one state such as established or time-wait.