`ss -tulpan` instead of `netstat`

Network · Diagnostics

Studied · 2026-04-15

Problem

On a busy host with tens of thousands of sockets, netstat takes several seconds, doesn't show namespaces and is officially deprecated on many modern distributions (net-tools was dropped in favor of iproute2). In 2026 people still reach for it out of a habit from 2005.

Solution

Switch to ss from the iproute2 package — the utility "to investigate sockets" (man ss). A basic set of flags covers 90% of diagnostic tasks:

-t — TCP
-u — UDP
-l — listening sockets only
-p — show the owning process
-a — all states, not only LISTEN
-n — don't resolve ports/addresses to names

The mnemonic tulpan (Russian for "tulip") sticks immediately and covers the typical "who listens on what and who has connections" case.

Example

# Who listens on which ports (replaces netstat -tlnp)
ss -tlnp

# Everything at once: TCP + UDP, listen + established, processes, no DNS
ss -tulpan

# Only established TCP connections on port 443
ss -tan state established '( dport = :443 or sport = :443 )'

# Summary statistics for all sockets
ss -s

# Sockets of a specific process
ss -tp | grep nginx

A typical "port already in use" incident:

$ ss -tlnp sport = :8080
LISTEN 0 128 0.0.0.0:8080 0.0.0.0:* users:(("old-service",pid=4821,fd=6))

One command shows the port, the PID and the process name.

When to use

On any production host instead of netstat.
In Ansible playbooks: ansible.builtin.command: ss -tulpan.
In "something is listening on the port and I don't know what" incidents.

Source

trimstray/the-book-of-secret-knowledge — the Networking section
man ss(8) — the full table of state filters and the filter syntax

How to apply it yourself

Make sure iproute2 is installed: ss --version.
Add an alias to ~/.bashrc / ~/.zshrc:
```
alias listen='ss -tulpan'
```
Update internal runbooks: wherever the instructions say netstat, change it to ss.
After the first real incident investigated with ss, move the status to Studied.

ss -tulpan instead of netstat