From 1fb19e6e456579f3c768ee208e5c0da077a20da7 Mon Sep 17 00:00:00 2001
From: root <pirouz.radin@yahoo.com>
Date: Tue, 29 Jul 2025 19:47:19 +0330
Subject: [PATCH] netstat & ss command

---
 Linux/LPIC1/22-netstat.md | 102 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 102 insertions(+)

diff --git a/Linux/LPIC1/22-netstat.md b/Linux/LPIC1/22-netstat.md
index e69de29..42e325d 100644
--- a/Linux/LPIC1/22-netstat.md
+++ b/Linux/LPIC1/22-netstat.md
@@ -0,0 +1,102 @@
+# 🌐 `netstat` and `ss` Command Documentation
+
+This guide provides essential usage examples for the `netstat` and `ss` commands to monitor network connections, listening ports, and socket statistics in Linux.
+
+---
+
+## 📡 `netstat` – Network Statistics
+
+`netstat` is a legacy tool used for displaying network connections, routing tables, interface statistics, masquerade connections, and multicast memberships.
+
+> ⚠️ `netstat` may be deprecated on some systems. Consider using `ss` as a modern replacement.
+
+### 🔍 Show All Active Network Connections
+
+```bash
+netstat
+```
+
+* Displays all active sockets (both listening and non-listening).
+* Includes TCP, UDP, UNIX domain sockets, etc.
+
+---
+
+### 🎧 Show Listening Ports
+
+```bash
+netstat -l
+```
+
+* Lists all **listening** ports (TCP and UDP).
+* Useful for checking which services are waiting for incoming connections.
+
+---
+
+### 🔒 Show Listening TCP Ports
+
+```bash
+netstat -lt
+```
+
+* Lists only **TCP** ports in the **listening** state.
+
+---
+
+### 📡 Show Listening UDP Ports
+
+```bash
+netstat -lu
+```
+
+* Lists only **UDP** ports in the **listening** state.
+
+---
+
+### 🧠 Show Listening TCP/UDP Ports with Process Info
+
+```bash
+netstat -tulpn
+```
+
+* Shows all listening **TCP/UDP** ports.
+* Includes **process ID (PID)** and **program name**.
+* Useful for identifying which service is using a specific port.
+
+---
+
+## ⚡ `ss` – Socket Statistics (Modern Alternative)
+
+`ss` is a faster and more powerful alternative to `netstat` for displaying socket statistics.
+
+### Common `ss` Options
+
+| Option | Description                                  |
+| ------ | -------------------------------------------- |
+| `-t`   | Show TCP sockets                             |
+| `-u`   | Show UDP sockets                             |
+| `-l`   | Show only listening sockets                  |
+| `-n`   | Show numerical addresses (no DNS resolution) |
+| `-p`   | Show process using the socket                |
+| `-a`   | Show all sockets                             |
+
+### Example – Show Listening TCP/UDP with Process Info
+
+```bash
+ss -tulpn
+```
+
+* Equivalent to `netstat -tulpn`
+* Recommended for modern Linux distributions.
+
+---
+
+## ✅ Summary
+
+| Task                                | `netstat` Command | `ss` Equivalent |
+| ----------------------------------- | ----------------- | --------------- |
+| Show all connections                | `netstat`         | `ss -a`         |
+| Show listening ports                | `netstat -l`      | `ss -l`         |
+| Show listening TCP ports            | `netstat -lt`     | `ss -lt`        |
+| Show listening UDP ports            | `netstat -lu`     | `ss -lu`        |
+| Show listening TCP/UDP with process | `netstat -tulpn`  | `ss -tulpn`     |
+