ss vs netstat: the translated runbook

■ space · prose lane

THE TRANSLATED RUNBOOK

Every netstat line you have in an old runbook, and what it becomes — read each row left to right:

the first two rows are identical — by luck, ss's short flags line up with netstat's for the common cases, so muscle memory mostly survives the move

IS NETSTAT DEPRECATED?

On Linux, effectively yes. The net-tools package — netstat, ifconfig, route — has not tracked modern kernel features for years and is no longer installed by default on any major distribution. It still exists, still runs, and there is nothing to uninstall, but new features land only in iproute2 (the package behind ss and ip). Three practical consequences:

1. Missing on fresh installs. A default Ubuntu 24.04 or Fedora server has no netstat until you install net-tools by hand — which is why so many people search for "the netstat equivalent": the binary is simply gone.
2. No modern socket info. netstat predates TCP fast open, subflow-level socket stats, and cgroup socket attribution. ss reports them natively.
3. The Windows exception. On Windows, netstat is alive and well — netstat -ano is still the standard way to map a PID to a listening port there. Only the Linux story is deprecation.

THE WORKHORSE, FLAG BY FLAG

ss means "socket statistics": the kernel's view of every TCP, UDP and Unix socket — state, addresses, ports, processes, timers, queue depths.

# everything listening, with the owning process
sudo ss -tulpn

Flag by flag: TCP (-t), UDP (-u), listening only (-l), show processes (-p), numeric output — no DNS lookups (-n). The sudo matters for -p: without root you see ports but get no process names for sockets you do not own. Two more one-liners that cover most of the job:

# all established connections to/from port 443, with processes
sudo ss -tnp 'sport = :443 or dport = :443'

# summary table: how many sockets in each state
ss -s

That filter syntax is a genuine upgrade over netstat's grep-and-pray approach — it runs inside the kernel, so it is exact rather than text-matched.

WHO OWNS PORT 8080?

The single most common reason to reach for either tool:

sudo ss -ltnp 'sport = :8080'

State   Recv-Q  Send-Q  Local Address:Port  Peer Address:Port  Process
LISTEN  0       511     *:8080              *:*               users:(("node",pid=214113,fd=18))

The users:(...) field gives you the process name and PID directly — no second command needed. Port busy but no process shows? You are usually looking at a socket held by another network namespace — a container. From the host, sudo ss -ltnp shows the port with an empty process column; match it with docker ps or nsenter into the container's namespace. Prefer a dedicated tool? sudo lsof -i :8080 -sTCP:LISTEN does the same job and works identically on macOS and most BSDs, which is why it survives in runbooks — but on Linux, ss is already there.

verify: sudo ss -ltnp 'sport = :8080' → users:(("node",pid=…)) · swap in any port 1–65535

WHY IS ss NOT FOUND?

Because you are either on a very old distro (pre-2007-era, before iproute2 was standard) or — far more likely — not on Linux at all. ss is not a macOS command; macOS ships lsof and netstat but no ss, same for the BSDs mostly. On Windows: netstat -ano or PowerShell's Get-NetTCPConnection. If you genuinely are on Linux and it is missing, install iproute2: sudo apt install iproute2 (Debian/Ubuntu) or sudo dnf install iproute2 (Fedora/RHEL).

verify: ss -V → a version string on the first line

WHEN NETSTAT STILL EARNS ITS ROW

Two honest cases. Portability: on a mixed fleet of Linux, AIX, or older BSD boxes, netstat is the one syntax present everywhere. Muscle-memory continuity in old runbooks — if a runbook says netstat -tlpn and the box has net-tools installed, it still works fine. Otherwise default to ss and update the runbook — the translation table at the top is the one worth taping to your monitor. And when the port you find belongs to a service that will not come up, that's a systemd story, not a socket story.

end of the translated runbook · nothing fetched · everything local