Network & Process Inspection

Finding what's listening on a port, what a process has open, what syscalls it's making, and what's actually on the wire.

Sockets and listening ports — ss (modern) and netstat (legacy)#

Copy
ss -tulpn                              # all TCP+UDP listening sockets, with PID/program, numeric ports
ss -tan state established              # established TCP connections only
ss -s                                  # summary counts by protocol/state

netstat -tulpn                         # the older equivalent of the ss command above
netstat -r                             # kernel routing table

ss is the current tool — it reads directly from the kernel and is significantly faster on a host with many connections; netstat (from net-tools) is legacy and not installed by default on many modern distros, including this one. Know both: ss for anything you run yourself, netstat for reading someone else's old runbook or a minimal/legacy host where ss isn't available either.

What's using a file, port, or directory — lsof#

Copy
lsof -i :8080                          # what process (if any) is bound to port 8080
lsof -p 12345                           # every file descriptor a specific PID has open
lsof -u myuser                          # every open file belonging to a user
lsof +D /var/log                         # every process with an open file under a directory

lsof -i :PORT is usually the fastest way to answer "what's already using this port" when a service fails to bind on startup — faster than cross-referencing ss -tlpn output by eye.

Tracing syscalls — strace#

Copy
strace -p 12345                          # attach to a running process and watch its syscalls live
strace -f -p 12345                        # + follow any child processes it forks
strace -c -p 12345                        # summary: syscall counts and time spent, not a live stream
strace -e trace=network -p 12345           # only network-related syscalls (connect, accept, sendto, ...)
strace -tt -o trace.log myprogram arg1     # run a fresh command under strace, with timestamps, to a file

strace adds real overhead to the traced process — fine for a one-off diagnostic attach, but not something to leave running against a production process under load without deciding that tradeoff deliberately first.

Capturing packets — tcpdump#

Copy
tcpdump -i eth0                              # capture on a specific interface
tcpdump -i eth0 -n                            # -n: don't resolve hostnames (faster, avoids DNS noise in output)
tcpdump -i eth0 port 443
tcpdump -i eth0 host 10.0.1.5 and port 443
tcpdump -i eth0 -w capture.pcap               # write raw packets to a file for later analysis (e.g. in Wireshark)
tcpdump -i eth0 -c 100 -X                       # capture exactly 100 packets, with hex+ASCII payload dump

Capturing on the wrong interface (eth0 vs a container's veth vs lo) is the most common reason "tcpdump shows nothing" during an actual incident — tcpdump -D lists every available interface if you're not sure which one carries the traffic you're chasing.