difference between netstat and ss in linux?

linux sockets netstat
daehee picture daehee · Aug 1, 2012 · Viewed 25.2k times · Source

In linux, netstat command tells us information of active sockets in system.

I understand that netstat uses /proc/net/tcp to acquire the system network information.

Since netstat man page says that netstat is obsolete, so we should use 'ss'.

NOTE
   This program is obsolete.  Replacement for netstat is ss.   Replacement
   for  netstat -r is ip route.  Replacement for netstat -i is ip -s link.
   Replacement for netstat -g is ip maddr.

I have discovered that ss performs similar functionality but it does not use /proc/net/tcp to acquire system network information.

Now I am curious how ss gets system network socket information?

Answer

ggiroux picture ggiroux · Aug 2, 2012

It gets them from kernel space directly using Netlink which uses the classic sockets API.

Related questions

listing multicast sockets

I am trying to list all opened multicast sockets on a linux system? netstat -g lists the groups joined though. Is there any other utility that I can use for this sake? Thanks a lot for the help.

Read More
How do I remove a CLOSE_WAIT socket connection

I have written a small program that interacts with a server on a specific port. The program works fine, but: Once the program terminated unexpectedly, and ever since that socket connection is shown in CLOSE_WAIT state. If I try …

Read More
How do SO_REUSEADDR and SO_REUSEPORT differ?

The man pages and programmer documentations for the socket options SO_REUSEADDR and SO_REUSEPORT are different for different operating systems and often highly confusing. Some operating systems don't even have the option SO_REUSEPORT. The WEB is full of …

Read More