Active TCP Connections

To view active TCP connections on your computer after visiting a website, you can use the following commands in Debian/Ubuntu:

---

1. Using ss (Recommended)

ss -t

Explanation:

• Lists all active TCP connections.
• Faster and more modern than netstat.

Options:

• -t – Show TCP connections only.
• -a – Show all connections (including listening).
• -n – Show numerical addresses (skip DNS resolution).
• -p – Show the process using the connection.

  
  ss -tanp
  

---

2. Using netstat (Legacy)

netstat -at

Explanation:

• Displays all active TCP connections.

Options:

• -a – Show all active connections.
• -t – Show TCP connections.
• -n – Show numerical addresses (no DNS lookup).
• -p – Show process names.

Example (with processes):

netstat -antp

Install netstat (if not installed):

sudo apt install net-tools

---

3. Using lsof (List Open Files)

lsof -i TCP

Explanation:

• Lists all open TCP network connections.
• Shows the program associated with each connection.

Example (filter for websites):

lsof -i :80 -i :443

• Shows HTTP (port 80) and HTTPS (port 443) connections.

---

4. Using ip and /proc (Raw Socket Information)

cat /proc/net/tcp

Explanation:

• Shows low-level TCP socket details.
• Can be hard to interpret directly, but useful for deep analysis.

---

5. Real-time Monitoring (Watch Active Connections)

watch -n 1 ss -tan

Explanation:

• Refreshes the TCP connection list every second.
• Useful to monitor connections as they change in real-time.

---

Example Workflow (After Visiting a Website):

1. Visit a website

   firefox google.com

2. Check active TCP connections

   ss -tanp

3. Filter for specific IP or ports

   ss -tan | grep 443

---