Inspecting Connections with netstat, ss, and curl

Understanding active network connections is essential for security auditing, troubleshooting, and performance analysis. The `ss` command (socket statistics) is the modern replacement for `netstat`. Both show listening ports, established connections, and associated processes. The `-tulnp` flag combination (`-t` TCP, `-u` UDP, `-l` listening, `-n` numeric, `-p` process) is the most commonly used invocation. The `curl` command transfers data using various protocols (HTTP, HTTPS, FTP, and more). It is indispensable for testing REST APIs, downloading files, checking HTTP response headers, and debugging web server configurations. The `-v` flag enables verbose output showing request/response headers, and `-I` fetches only headers. `wget` is a simpler alternative focused on file downloading with resume support. The `ping` command tests basic connectivity and measures round-trip time using ICMP echo requests. `traceroute` (or `tracepath`) maps the network path to a destination by incrementing the TTL and recording each hop. These tools are the first line of diagnosis when network connectivity issues arise.

Example

# ---- ss: socket statistics ----

# Show all TCP and UDP listening ports
ss -tulnp

# Show all established TCP connections
ss -tnp state established

# Show connections to a specific port
ss -tnp sport = :443

# Show all sockets (listening + established)
ss -anp

# ---- netstat (legacy) ----
netstat -tulnp          # Listening ports with processes
netstat -an             # All connections

# ---- curl examples ----

# Simple GET request
curl https://api.github.com/users/torvalds

# Follow redirects
curl -L https://example.com

# Download a file
curl -O https://example.com/file.tar.gz

# Download and save with custom name
curl -o myfile.tar.gz https://example.com/file.tar.gz

# Show response headers only
curl -I https://example.com

# Verbose output (headers + body)
curl -v https://example.com 2>&1 | head -50

# POST JSON data
curl -X POST https://api.example.com/data \
     -H "Content-Type: application/json" \
     -H "Authorization: Bearer $TOKEN" \
     -d '{"key": "value"}'

# Check HTTP status code only
curl -o /dev/null -s -w "%{http_code}" https://example.com

# ---- wget ----
wget https://example.com/file.tar.gz
wget -c https://example.com/largefile.iso   # Resume interrupted download
wget -q --spider https://example.com        # Check URL without downloading

# ---- ping and traceroute ----
ping -c 4 google.com
traceroute google.com
tracepath google.com

HTML

Full Editor

Related Resources

Linux / Bash Reference

Complete tag & property list

Linux / Bash How-To Guides

Step-by-step practical guides

Linux / Bash Exercises

Practice what you've learned