Inspecting Network Connections and Sockets

Knowing which ports are open and which connections are live is key to debugging services, catching unexpected traffic, and confirming an app listens where you expect.

The modern tool for socket inspection is ss (socket statistics). It replaces older netstat and runs far faster on busy systems.

To see what's listening, stack flags: -l listening, -t TCP, -u UDP, -n numeric. Together: ss -tuln.

Add -p to reveal the process behind each socket — the fast answer to "what is using port 8080?"

Drop -l to see established connections instead of listeners — who your machine is actually talking to right now.

ss takes powerful filters. Target a single port — like :443 — to focus only on HTTPS traffic.

TCP sockets cycle through states like LISTEN, ESTABLISHED, TIME-WAIT, and CLOSE-WAIT. Plenty of CLOSE-WAIT often means an app isn't closing sockets.

Pipe ss into wc -l to count connections — a quick way to spot connection leaks or rising load.

lsof lists open files, including network sockets. Run sudo lsof -i :8080 for a fast, targeted per-port lookup.

ss -s prints a one-line summary of socket counts by type and state — a fast health glance for a server.

Drop the -n and ss resolves host and service names — friendlier to read, but slower on busy hosts.

Test your socket-inspection knowledge.

Recap: ss is the fast modern tool — ss -tuln lists listeners, -p finds owning processes, and lsof -i gives quick per-port lookups.