Check Network Connection Count on a Linux Server

Use ss, netstat, /proc/net, and lsof to check the number of network connections on a Linux server, with status statistics and troubleshooting steps.

TL;DR

• Recommended: ss (bundled with iproute2, no install needed): ss -s for the overview, ss -tan for the list, ss -tan state established to filter by state^[1].
• netstat comes from net-tools; Ubuntu 24.04 does not install it by default, and its official manpage is marked obsolete – keep it only as a compatibility reference^[2].
• No packages needed: read /proc/net/sockstat and /proc/net/tcp^[3].
• Pinpoint by process with lsof -i -nP; check the conntrack table with conntrack -C (requires installing conntrack)^[4][5].

ss: The Modern Default

ss is the socket statistics tool from the iproute2 suite; it reads the kernel netlink interface directly, making it faster than netstat^[1].

ss -s
ss -tan state established
ss -tan state listening
ss -tanH | awk '{print $1}' | sort | uniq -c

ss -s gives TCP/UDP/RAW/FRAG summaries plus TCP state counts; -t TCP, -a all (including listening), -n no service-name resolution; -H drops the header for scripting; the state filter selects by connection state^[1].

netstat: For Legacy Scripts

netstat comes from net-tools, Ubuntu 24.04 does not install by default, manpage marked obsolete.

netstat: For Legacy Scripts

netstat comes from net-tools, which Ubuntu 24.04 does not install by default; its manpage states plainly “This program is mostly obsolete. Replacement for netstat is ss”^[2].

sudo apt-get install -y net-tools
netstat -tan
netstat comes from net-tools, Ubuntu 24.04 does not install by default, manpage marked obsolete.
sudo apt-get install -y net-tools
netstat -tan
netstat -s | grep -i tcp

-t TCP, -a all, -n numeric form. Use only when maintaining old scripts or old systems; prefer ss on new setups.
No Install: Read /proc Directly
The kernel exposes connection stats under /proc, readable in any shell environment.
cat /proc/net/sockstat
wc -l /proc/net/tcp /proc/net/tcp6

/proc/net/sockstat outputs something like TCP: inuse 3 orphan 0 tw 6 alloc 3 mem 0, where inuse is the number of allocated TCP sockets and tw is the TIME-WAIT count. Each line in /proc/net/tcp is one IPv4 TCP connection (including the header), so the count minus one is the connection count; IPv6 goes through tcp6.
Note: In containerized environments like WSL2, /proc/net is a network-namespace view reflecting only the current namespace.
lsof: Pinpoint by Process
lsof -i -nP | head

-i selects network files, -n skips hostname resolution, -P skips port-name resolution. Useful for answering "who owns this connection."
conntrack: NAT/Firewall Connection Tracking Table
On firewalls/NAT gateways with conntrack enabled, the tracking table size reflects real concurrency.
sudo apt-get install -y conntrack
conntrack -C

-C prints the current number of entries in the tracking table. On an idle host it may be 0.
Rollback

Uninstall net-tools/conntrack after use: apt-get purge -y net-tools conntrack && apt-get autoremove --purge -y
No persistent system changes; /proc is read-only.

Troubleshooting Quick Reference



Symptom
Cause
Fix




ss: command not found
iproute2 not installed (rare)
apt-get install iproute2


netstat: command not found
net-tools not installed (default on Ubuntu 24.04)
Switch to ss, or install net-tools


Connection count looks too low
Only IPv4 was checked
Also check /proc/net/tcp6 or use ss -6


conntrack -C errors out
conntrack module not loaded / no permission
Run as root, or check kernel modules


Numbers disagree with monitoring platform
Different sample time / namespace
Standardize on ss -s with a fixed sampling interval



Verified on

Tested environment: WSL2 Ubuntu 24.04.4 LTS, iproute2 6.1.0.
Verified: ss -s / ss -tan / ss -tan state listening output; /proc/net/sockstat, /proc/net/tcp line counts; lsof -i; installed and ran netstat and conntrack, then uninstalled to restore.
Limitations: WSL2 is a single namespace with no real high-concurrency traffic; conntrack table is 0 on an idle VM, so high-load scenarios unverified; network namespace switching (ip netns exec) not tested.


References

[1] ss(8) - Linux manual page (man7.org) (man7-ss)
[2] netstat(8) - Ubuntu manpages (noble) (ubuntu-netstat)
[3] /proc/pid/net/, /proc/net/ - Ubuntu manpages (noble) (proc-net)
[4] lsof(8) - Ubuntu manpages (noble) (ubuntu-lsof)
[5] conntrack(8) - Debian bookworm (debian-conntrack)

Key commands in this article were tested on WSL Ubuntu (24.04) and cross-checked against Debian-family and general-distribution documentation.