Hands-on Lab·Linux Foundation Certified System Administrator
What is listening, and what is connected
Before you can firewall a port or debug a service you have to know what is on it. ss answers that, and its flags are terse enough that most people memorise one invocation and stop. This guide takes them apart, and proves the resolver cache from the name-resolution page along the way.
Networking Guide 28 of 38 Beginner
- PlatformsUbuntu 26.04 LTS + AlmaLinux 10.2
- LVM2.03.31 (Ubuntu) / 2.03.36 (AlmaLinux)
- nftables1.1.6 (Ubuntu) / 1.1.5 (AlmaLinux)
- TimeAbout 12 min
ss is iproute2 and identical on both families. netstat is deprecated and not installed on a minimal system - ss is faster and reads the kernel directly.
- Firewallufw 0.36.2 enabled but reporting inactive / firewalld active
- Network confignetplan + systemd-networkd / NetworkManager 1.56.0
| Server Name | IP Address | OS | Roles | CPU | RAM | HDD |
|---|---|---|---|---|---|---|
| LFCS-A01 | 192.168.0.70 | Ubuntu 26.04 LTS | Primary host - most guides run only here | 2 Core | 4 GB | 50 GB |
| LFCS-C01 | 192.168.0.72 | AlmaLinux 10.2 | The other distribution - dnf, firewalld and NetworkManager | 2 Core | 4 GB | 50 GB |
This guide includes
Use this before firewalling a port or debugging a service. This matters because you cannot decide what to allow until you know what is bound, and which address it is bound to.
- clearing the resolver cache the previous guide left behind
- finding what this machine is listening on, with the invocation worth memorising
- filtering, and seeing what is actually connected
- running the same command on the busier host
Before you start
- guide 17 - the PIDs in this output.
-
The cache, finally cleared
-
What this machine is listening on
-
Filtering, and what is actually connected
-
The same command on the other family