netstat to ss: how it actually started for me
I used netstat for years out of pure habit. It’s the first thing you learn, it’s on every cheat sheet, and it worked; until it didn’t.
The moment it broke for me wasn’t dramatic. I was on a server with a few thousand active connections, running netstat -tulpn like I’d done a hundred times before, and it just… sat there. A couple of seconds longer than it should’ve. Not broken, just slow enough to notice. On a box with a normal connection count you’d never see it. On this one, it was obvious something was off.
Around the same time, I kept running into newer write-ups mentioning ss as the “modern replacement”!! the kind of line that usually makes me roll my eyes, because half the time “modern replacement” just means someone renamed the same tool for a blog post. I almost skipped it for that reason. But the slowness was a real, repeatable problem, so I actually tried it side by side on the same box.
ss -tulpn came back close to instantly. Same data, same box, same connection count. That gap was too big to ignore.
Here’s the actual reason, not just “it’s faster, trust me”: netstat builds its output by parsing /proc/net/tcp and friends line by line, plus doing reverse lookups depending on your flags; it’s working through a text interface to the kernel. ss skips that entirely and talks to the kernel directly over a netlink socket. Less parsing, less overhead, and it scales a lot better as connection count goes up. On a lightly loaded box you won’t feel the difference. On a server pushing thousands of sockets, it’s not subtle.
I didn’t rip netstat out of my muscle memory overnight, old habits don’t die that fast, and honestly netstat -r is still what I type half the time out of reflex. But ss is what I reach for now on anything with real traffic, and it’s what I’d tell anyone starting out to learn first instead of picking it up as an afterthought years in.
A few I use daily, if you’re making the switch:
-
ss -tulpn : listening sockets, the direct netstat replacement
-
ss -s : quick socket summary, good first check on a box you don’t know
-
ss state established : filter to just live connections, no grepping required
-
ss -tn state syn-sent state syn-recv : filter out all syn receive and syn sent connections
Small tool, small change, but it’s the kind of thing that only shows up when you’re actually under load, which is exactly when you need your tools to not be the bottleneck.
If you want to check your own server, I built a small SYN cookie checker that reads the ss/sysctl output and tells you what it actually means.