Cybersecurity Triage
Read-onlyInspect Established Network Connections
You need to list established TCP connections without changing network state.
Command
ss -tan state establishedBefore you run this
System impact: Read-only. Low when scoped to the shown target.
When not to use it: Do not treat it as a full security investigation; it is a point-in-time socket snapshot.
Expected output
A list of established TCP connections showing local and peer addresses and ports.
System impact
Read-only. Nothing changes. The command displays current established TCP sockets.
Recovery / rollback: no state is changed.
When to use it
Use when checking active client connections, suspicious network activity, or service traffic.
When not to use it
Do not treat it as a full security investigation; it is a point-in-time socket snapshot.
next steps
Related commands
Find Listening Ports with ss
Before blaming the firewall, check whether anything is actually listening.
ss -ltnp
List Listening Ports on a VPS
Unexpected network listeners are first-response evidence.
ss -ltnp
List Listening TCP Sockets
Firewall rules matter after you know what is listening.
ss -ltnp
Find Allowed Ports with No Listener
An open firewall rule can outlive the service it was created for.
comm -23 <(ufw status numbered | awk '/ALLOW/ {print}' | grep -Eo '[0-9]+/(tcp|udp)' | cut -d/ -f1 | sort -u) <(ss -ltnp | awk '/LISTEN/ {n=split($4,a,":"); print a[n]}' | sort -u)
Check Whether Databases Listen Publicly
The fastest database security check is the listening address.
ss -ltnp | awk '$4 ~ /:(5432|3306)$/ {print}'
Study mapping
Use this as independent command practice: read the notes, predict the output, then compare it with the example before using a real shell.
Independent study support only. No affiliation, endorsement, exam dumps, or real exam questions.