difference between netstat and ss in linux?

user_1528889 0
Viewed 30787

In linux, netstat command tells us information of active sockets in system.

I understand that netstat uses /proc/net/tcp to acquire the system network information.

Since netstat man page says that netstat is obsolete, so we should use 'ss'.

NOTE
   This program is obsolete.  Replacement for netstat is ss.   Replacement
   for  netstat -r is ip route.  Replacement for netstat -i is ip -s link.
   Replacement for netstat -g is ip maddr.

I have discovered that ss performs similar functionality but it does not use /proc/net/tcp to acquire system network information.

Now I am curious how ss gets system network socket information?

netstat sockets linux
5 Answers

I've made a comparison table (in Google Docs) (light HTML link) for converting between netstat and ss arguments. It's too big to include and update it here.

google doc screenshot

The short version of difference between short arguments is:

Arguments that require attention: r N i g M W T v C F c A U 2 f

Arguments that are safe to leave as is: h V l a n Z s p e o 4 6 x t u S w

user_8544770

ss is a utility used to investigate sockets in Linux and Unix systems. It shows information similar to netstat and able to dump socket statistics.

But netstat cannot be replaced full by ss. Some netstat commands correspond better to ip command.

    $ netstat -r   replaced by  $ ip route
    $ netstat -i   replaced by  $ ip -s lin
    $ netstat -g   replaced by  $ ip maddr

I would say the "older" netstat command can be replaced with both ss and ip commands.

user_58849550
Related