netstat Commands: ss Equivalents Cheat Sheet (2026)

netstat Commands

netstat shows sockets, connections, and listening ports, but modern Linux ships ss as its replacement and often does not install netstat at all. This sheet maps every common netstat command to its ss equivalent, covers ss filters, and includes the Windows netstat commands, which are alive and well.

Last updated September 5, 2026

netstat to ss Mapping

netstat is deprecated on Linux; ss is the replacement and takes the same flag letters for the common cases. The last two rows moved to instead.

netstat	ss / ip	What it shows
		Listening TCP ports with the owning process
		Listening UDP ports with the owning process
		Both, one table
		All sockets, listening and connected
		Current TCP connections, numeric
		Summary statistics by protocol
		Routing table
		Interfaces with packet and error counters

The letters mean: TCP, UDP, listening only, numeric (skip DNS, always worth it), process info (needs for other users' processes), all.

Listening Ports

Command	What it does
	Every listening TCP port and who owns it
	Is something on port 80
	Same, filtered by ss itself
	TCP and UDP listeners together
	Listening sockets without process info (no sudo needed)
	Which port is sshd actually on

If a port shows a listener bound to , it only accepts local connections; or means all interfaces. To test a port from the outside instead, use the SSH port checker.

Established Connections

Command	What it does
	All current TCP connections
	Only live connections
	Live connections with the owning process
	Outbound HTTPS connections
	Connections to one host
	How many sockets in TIME_WAIT

Recipes:

# Who is connected to my web server right now, by IP:
ss -tn state established '( sport = :443 or sport = :80 )'

# Count connections by state (spot SYN floods and CLOSE_WAIT leaks):
ss -tan | awk 'NR>1 {print $1}' | sort | uniq -c | sort -rn

# Count established connections per client IP:
ss -tn state established | awk 'NR>1 {split($5,a,":"); print a[1]}' | sort | uniq -c | sort -rn

ss Filters

ss filters sockets itself, no grep needed. Quote the expression, and put spaces around the parentheses and operators.

Command	What it does
	Filter by state (, , , also work)
	By destination port
	By source (local) port
	Either port
	Connections to a subnet
	Port comparisons work too
	Kill matching connections (kernel support required)

Routing Table and Stats

The parts of netstat that ss does not cover, and their modern forms.

Command	What it does
	Routing table (); the line is your gateway
	Which route and interface a destination would use
	Interfaces with RX/TX and error counters ()
	Socket totals by state and protocol ( is more detailed)
	Full per-protocol counters: retransmits, resets, ICMP (needs net-tools)

Windows netstat

netstat is not deprecated on Windows. Run these in an elevated Command Prompt or PowerShell; is Windows grep.

Command	What it does
	All connections and listeners, numeric, with PID
	Filter to one port
	Listeners only
	Live connections only
	Name the process behind PID 4312
	Show the executable name inline (needs an admin prompt, slower)
	Routing table
	Interface byte and packet counters
	Reprint every 5 seconds (Ctrl+C stops)
	Kill the process holding a port

macOS netstat

macOS ships a BSD netstat with different flags, and no for processes ( selects a protocol instead). Use for the process view.

Command	What it does
	Listening ports
	TCP sockets ( for UDP)
	Which process is on port 8080
	Every listener with its process
	Routing table

Gotchas

on a modern distro is expected: the default answer is , and brings netstat back if a script insists on it.
Without , the column is blank for processes owned by other users, including every system service. No error, just missing names.
Always add . Without it both tools resolve every address and port name, which is slow and turns into mid-scan.
ss filter expressions are picky about spacing: works, does not.
A service bound to will look fine in but be unreachable from outside. Check the Local Address column, not just the port.
Connections you see in ss can still be invisible to clients if the firewall drops packets first. When listeners look right but connections fail, capture with tcpdump and check iptables.

netstat & ss Cheat Sheet FAQ

Why does Linux say netstat: command not found?

netstat lives in the net-tools package, which Ubuntu, Debian, RHEL, and Arch stopped installing by default years ago. The intended replacement is ss, which is already there: ss -tlnp does what netstat -tlnp did, usually faster. If you want the old command anyway, sudo apt install net-tools on Debian and Ubuntu or sudo dnf install net-tools on RHEL and Fedora brings it back. For the routing table and interface stats that netstat also covered, the replacements are ip route and ip -s link rather than ss.

Is ss a full replacement for netstat?

For sockets, yes: every common netstat invocation has an ss equivalent with the same flag letters, and ss adds state and port filters netstat never had. But netstat also printed the routing table (-r) and interface statistics (-i), and ss does not do either; those moved to ip route and ip -s link from the same iproute2 package. So the full replacement is ss plus ip. The output formats differ too, so scripts that parse netstat output need adjusting, not just a name swap.

How do I find which process is using a port?

On Linux: sudo ss -tlnp 'sport = :8080' or sudo ss -tlnp | grep :8080, and the process name and PID appear in the last column. Run it with sudo, otherwise you only see processes you own. On Windows: netstat -ano | findstr :8080 gives the PID in the last column, then tasklist | findstr <PID> names the program. On macOS, netstat cannot show processes at all; use sudo lsof -i :8080 instead. If nothing is listed, nothing is listening on that port, and a connection attempt will be refused.

What does ESTABLISHED mean in netstat output?

It is a TCP state: the handshake finished and the two ends can exchange data, so each ESTABLISHED row is a live connection. LISTEN means a server socket waiting for connections, TIME_WAIT is a connection you closed recently and the kernel is holding briefly (normal, harmless in the hundreds), CLOSE_WAIT means the other side hung up and your program has not closed its socket, which in large numbers points at a bug, and SYN_SENT means you asked to connect and nothing has answered yet, the signature of a firewall dropping packets.

How do I run netstat continuously?

Old netstat had -c, which reprinted every second. With ss, wrap it in watch: watch -n1 'ss -tnp' redraws the table each second, and watch -n1 ss -s is a compact live view of connection counts by state. On Windows, a trailing number does it natively: netstat -ano 5 reprints every five seconds until Ctrl+C. For watching one thing, narrow it first, e.g. watch -n1 "ss -tn 'dport = :443'" to watch outbound HTTPS connections come and go.