Using netstat and ss: Which IPs Are Connected to You Right Now?

Introduction: The Guest List

If your computer is slow or acting suspiciously, the first question to ask is: "Who am I talking to?" For decades, the command to answer this was netstat. Today, Linux distributions use a faster, more modern tool called ss (Socket Statistics).

Finding the Intruders

By running a command like ss -ant, the terminal will print a list of every active TCP connection on your machine. You will see your computer's local IP address, the 'Foreign Address' (the external IP you are connected to), and the current state of the connection (like ESTABLISHED or TIME_WAIT). If you see a foreign IP you don't recognize connected to a strange port, you might have malware.

Conclusion

Running `ss` or `netstat` is like performing a roll-call for your network card. It is the fastest way to audit your digital borders. Run a connection scan here.