Tuesday, 20 October 2026

ss (socket statistics) versus netstat

netstat is used in Windows with roots in Unix. In the Linux world, ss is more used than netstat.

ss displays "socket statistics" and is used to "dump socket statistics" as per its description. 

Unlike netstat, ss talks to the Linux kernel directly. 

Used without arguments, ss displays non-listening connections - so an nginx server simply listening for connections would not appear in the output, but an established connection (TCP for example) would appear.

To display listening connections also, do ss -l.

ss -lt
ss -lu

Restricts output to TCP and UDP connections.

Please note: using ss in a WSL shell will only give you the connections relating to the shell and not the wider Windows system in which the shell is running. 

You will still need netstat from a cmd.exe to see the networking connections in Windows. Note that WSL1 shared more of the Windows networking stack than WSL2.

No comments: