Diagnosing Network Status with ss, netstat, and tcpdump

# Listening ports (TCP + UDP)
ss -tlunp

# Options: -t TCP, -u UDP, -l Listening, -n numeric, -p show process

# Check a specific port
ss -tlnp | grep :80

# All connection states
ss -ta

# ESTABLISHED connections only
ss -t state established

# Connections to a specific IP
ss dst 192.168.1.100

# Count connections by state
ss -t | awk 'NR>1 {print $1}' | sort | uniq -c

# Install
apt install net-tools   # Ubuntu/Debian
yum install net-tools   # CentOS/RHEL

# Check listening ports
netstat -tlnp

# Connection statistics summary
netstat -s | head -30

# Process occupying a specific port
netstat -tlnp | grep :3000

# Capture on a specific interface
tcpdump -i eth0

# Specific port (HTTP)
tcpdump -i eth0 port 80

# Traffic with a specific host
tcpdump -i eth0 host 8.8.8.8

# Save to a file (openable in Wireshark)
tcpdump -i eth0 -w /tmp/capture.pcap

# Inspect HTTP request contents
tcpdump -i eth0 -A port 80 | grep "Host:"

# SYN packets only (monitor connection attempts)
tcpdump -i eth0 'tcp[tcpflags] & tcp-syn != 0'

# Check whether port 3000 is open
ss -tlnp | grep 3000

# Check if the port is reachable from outside
nc -zv your-server.com 80

# Count TIME_WAIT connections
ss -t state time-wait | wc -l

# All connections for a specific process
ss -tp | grep nginx

# Top IPs by number of connections
ss -t state established | awk 'NR>1 {print $5}' | cut -d: -f1 | sort | uniq -c | sort -rn | head