**By:** webdevel@sparkhausmedia.com (Lori White)
© Lead Image ©Ioannis Kounadeas, Fotolia.com
We take a close look at the Socket Statistics utility ss and show why it is better than netstat for forensics, troubleshooting, and other networking tasks.
Anyone who has been around Linux long enough remembers when netstat [1] was the unquestioned go-to tool for checking socket activity.
Whether you needed to confirm a process was listening, trace an unexpected connection, or sanity-check a server during an outage, netstat felt dependable.
Because netstat was part of the Linux ecosystem for so long, most administrators stopped thinking about how it actually gathered its information.
It simply worked, at least, until modern workloads exposed its age.
The core limitation of netstat comes from its reliance on parsing text inside /proc/net/.
Every time the command runs, it has to read and interpret multiple pseudo-files line by line.
The approach originated when Linux systems handled far fewer connections and application architectures were simpler.
As long as socket tables remained small, the overhead of parsing them wasn’t noticeable.
But as servers began hosting thousands of short-lived connections, this design started to buckle.
When netstat parses /proc [2], it has to rebuild its view of the system from scratch each time.
On a lightly loaded system, this might take only a moment.
But on a busy reverse proxy, an API gateway, or a container-heavy host, those pseudo-files can grow large enough that the command feels sluggish or inconsistent.
The delay is minor when measured in seconds, but during a live incident, those seconds are exactly when you need an up-to-date picture of what the network stack is doing.
[…]
The unassuming ss utility is easy to understand and easy to type, but it adds some powerful options to your admin toolkit.
Linux tracks all the actions that take place on your system, including when your users were active and what they did.
Linux has the right tools to track down network errors and open the way for data packets.
Most sys admins use netstat to find out about the status of network sockets, but Charly knows a good shortcut.
In Linux, everything is a file – directories, devices, pipes – so lsof (list open files) reveals what’s happening on your system.
With continued DRAM and eMMC shortages, Pine64 has decided to discontinue production of Linux devices.
KDE, Techpaladin, and Kubuntu Focus have announced a new initiative that will provide at least three years of support for KDE Plasma 6.6 LTS and related software.
For those on Linux Mint who like to keep multiple kernels around but don’t want them to take up too much space, you might be getting a new automated tool.
CachyOS August 2026 release is now available with the latest version of KDE, some new features, and plenty of improvements.
Unless a kernel patch is a valid security fix, it will be rejected if it was created using AI.
According to two sources, the Linux operating system has hit a major milestone in market share that naysayers thought would never happen.
A use-after-free race exploit was discovered and exploited on CentOS Stream 9.
Affecting millions of systems, a kernel flaw discovered by Qualys could allow users to gain root privileges.
If you’ve ever wondered if your laptop or PC is officially certified to run Ubuntu, that curiosity will soon be met.
The lastest version of IPFire features a fundamental change to how the system handles DNS.
—
**📚 Original Source:**
[Why the Powerful ss Command Is Gradually Replacing netstat](http://www.linux-magazine.com/Issues/2026/309/Network-Monitoring-with-ss)
About The Author
