difference between netstat and ss in linux?

I've made a comparison table (in Google Docs) (light HTML link) for converting between netstat and ss arguments. It's too big to include and update it here.

google doc screenshot

The short version of difference between short arguments is:

Arguments that require attention: r N i g M W T v C F c A U 2 f

Arguments that are safe to leave as is: h V l a n Z s p e o 4 6 x t u S w


ss is included in iproute2 package and is the substitute of the netstat. ss is used to dump socket statistics. It shows information similar to netstat. It can display more TCP and state information than other tools. It is a new, incredibly useful and faster (compared to netstat) tool for tracking TCP connections and sockets.


It gets them from kernel space directly using Netlink which uses the classic sockets API.