Networking & Firewall (Ss/Netstat/Iptables/Nftables/Curl)

Stop guessing which process is hogging your ephemeral ports

🧩 The Challenge

You’ve got an application throwing connection refused errors, and you’re convinced the port is open but you can’t see who’s actually listening on the other side. It’s infuriating when netstat shows nothing and your application logs are just cryptic garbage.

💡 The Fix

Use ss to peer directly into the socket state with a filter that actually shows you the process ID attached to those connections. It cuts through the noise of thousands of connections and finds the one bad actor.

ss -tulpn | grep :80

⚙️ Why It Works

Adding the -p flag forces the kernel to look up the process associated with every socket it finds. Getting this data in real-time is the only way to prove which PID is binding to your interface when the logs are lying to you.

🚀 Pro-Tip: Stick an -o on there if you need to see keep-alive timers.

Linux Tips & Tricks | © ngelinux.com | 10/27/2026