From SpectLog
Jump to: navigation, search


Command ss [1] is a new generation utility compared to netstat.


Command netstat with single set of switches covers all connection in LISTEN and ESTABLISHED state. Running it under watch constantly provides overview of the network activity:

watch netstat -tupna

In order to reduce the list and focus on monitoring ESTABLISHED connection, remove -a (all) switch:

watch netstat -tupn


The meaning of many switches in ss command is borrowed from netstat, so the transition is seamless:

watch ss -tupna
watch ss -tupn


Another simple tool specifically for tracking TCP connections is tcptrack which also provides TUI interface:

tcptrack -i eth0

Note that it exists on Fedora but it is not included in the default package repository on Red Hat Linux.


Command nethogs is best to highlight specific processes which take most of the bandwidth.

nethogs eth0