Start with ss -tunap to see TCP and UDP sockets and, where permissions allow, the local processes using them. If you need a quick list of Internet sockets tied to commands, try sudo lsof -i -n -P. Use bandwidth monitors to find what is transferring data now; use packet capture only when you need to inspect traffic in more detail.
How to see active connections and their processes
ss is a useful first check: it reports socket state and can show the process associated with a socket. Its options and output can vary with the installed iproute2 version, so consult ss --help or the local manual if an option behaves differently.
As an Amazon Associate I earn from qualifying purchases.
Show TCP and UDP sockets
ss -tunapThis requests numeric TCP and UDP socket information across states, with process associations. Numeric output avoids translating addresses and ports into hostnames or service names. If process details are missing, try with appropriate privileges; access controls can limit what the command reveals.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Limit the list to listeners or established TCP sessions
ss -lntupThis narrows the view to listening TCP and UDP sockets. To focus on established TCP sessions instead, run:
#1 Best Overall
- VERSATILE CABLE TESTING: Cable tester tests voice (RJ11/12), data (RJ45), and video (coax F-connector) terminated cables, providing clear results for comprehensive testing on unenergized Ethernet cables (not designed to test PoE)
- EXTENDED CABLE LENGTH MEASUREMENT: Measure cable length up to 2000 feet (610 m), allowing for precise cable length determination
- COMPREHENSIVE FAULT DETECTION: Test for Open, Short, Miswire, or Split-Pair faults, ensuring thorough fault detection and identification
- BACKLIT LCD DISPLAY: Backlit LCD screen displays cable length, wiremap, cable ID, and test results, ensuring easy readability in various lighting conditions
- EFFICIENT CABLE TRACING: Trace cables, wire pairs, and individual conductor wires using the multiple style tone generator (requires analog probe Cat. No. VDV500-123, sold separately), simplifying cable tracing tasks
ss -tanp state establishedA listening socket is waiting for connections; an established socket represents an active TCP session. UDP does not use TCP’s connection-state model, so do not treat an absence of established UDP entries as proof that an application is not sending datagrams.
Use lsof to connect Internet sockets to commands
sudo lsof -i -n -Plsof lists open Internet socket files and associates them with commands and process IDs. The -n and -P options suppress hostname and service-name lookup, leaving numeric addresses and ports. Its -i filters can narrow results by protocol, host, address, or port; check the installed lsof documentation for the qualifier syntax supported on your system.
Rank #2
- Cable Performance testing up to 10GBASE-T via frequency-based measurements
- Network features including: IPv4 and v6 ping, nearest switch diagnostics (IP address, name, port / VLAN number, and advertised data rates)
- Ethernet Alliance certified PoE Verification – Detects the PoE class (1-8) and power, and performs a load test of available PoE from the connected switch
- Displays cable length, wire map, and distance to open or short
- Manage results and print reports from LinkWare PC
These commands take snapshots. A very short-lived connection may disappear before the listing runs, so repeat the check or switch to a live monitor if the activity is intermittent. A remote IP address and port identify an endpoint, but they do not necessarily tell you the human-readable service or why the local program contacted it.
Recommended Free Tools
When to use a bandwidth monitor
Socket listings tell you which endpoints and processes are present; they do not primarily answer how much data is moving at this moment. For a live view, iftop shows traffic flows on an interface, while nethogs focuses on bandwidth use by process. These tools complement rather than replace ss and lsof.
Rank #3
- Multifunctional NOYAFA NF-8508 Network Cable Tester: There are nine features to meet your needs. Continuity Testing, Cable Scan, Port Flash, Length Measurement, POE Power Supply Test, QC testing, Optical Power Meter, VFL and NVC function.It is perfectly suited for various engineering cabling projects, network troubleshooting, network equipment maintenance and testing scenarios. Its precise cable scanning and fault localization capabilities help you effortlessly pinpoint the root cause of issues.
- 7 WAVELENGTHS OPTICAL POWER METER: NF-8508 network cable tester can measure 7 standard wavelengths, 850/1300/1310/1490/1550/1625/1650, power detecting range(dBm): -70 ~ +10. Its power detection range spans from -70 dBm to +10 dBm, supporting FC/SC/ST connectors. It enables precise fiber optic power measurement, helping users efficiently assess fiber signal strength and ensure healthy fiber link operation. It effortlessly detects attenuation issues within fibers, thereby safeguarding fiber network stability.
- High Efficiency Visual Fault Locator: Easy identification of fiber breakpoints, poor connections, bending or cracking. Excellent for finding the right fiber to splice or quickly finding a break. Emmiting Energy: standard wavelenth: 650nm. Fast flashing, slow flashing, high precison.The built-in self-calibration ensures stable long-term performance, and Class IIIa laser (output<5mW) ensures safe daily operation.
- PORT FLASHING:The indicator light on the connection port in the NF-8508 device flashes to help accurately locate the cable. Displays port information, including operating speed, duplex mode, and negotiation settings. Port lights flash on the same screen to show the port's operating speed, making it easy to pinpoint lines and ports.
- PoE Testing and Cable Length Test: PoE testing can check cable mapping polarity and voltage of PoE network switches, withstand 60VDC. Automatically detects and switches between 10M/100M/1000M modes, Includes cable tracking, short circuit test, interruption of circuit test and etc The RJ45 cable tester can quickly measure the length of the cable with a range of 200m. Not only network cables, but also phone lines and BNC cables.
- Choose
iftopwhen you want to spot active network flows and their rates. - Choose
nethogswhen you want to identify which local process is using bandwidth.
Both are live monitoring views, not packet-content analyzers. Availability, installation method, and exact options depend on your Linux distribution and package version; consult its documentation rather than assuming one installation command or interface works everywhere.
When packet capture is worth the extra detail
If endpoint lists and rate views do not answer the question, capture packets for protocol-level inspection. tcpdump is a common command-line capture tool. Wireshark provides a graphical view of protocol layers and conversations and can inspect live traffic or saved captures; TShark offers terminal-based Wireshark analysis.
Rank #4
- VERSATILE CABLE TESTING: Cable tester for data (RJ45) terminated cables and patch cords, ensuring comprehensive testing capabilities
- LARGE BACKLIT LCD: Backlit LCD display enables easy reading of pin-to-pin wiremap results, even in low-lit areas
- COMPREHENSIVE FAULT DETECTION: Test for Open, Short, Miswire, Split-Pair faults, Cross-over, and Shield, providing thorough fault detection
- INTUITIVE USER INTERFACE: User-friendly interface with three buttons and simple, easy-to-identify test responses, ensuring a smooth testing experience
- MULTIPLE TONE GENERATOR STYLES: Tone on a single wire, wire pair, or all 8 conductor wires using the multiple style tone generator (solid/warble); requires probe Cat. No. VDV500-123 (sold separately)
Begin with a narrow capture filter and a short capture, then save only the data you need. In Wireshark, capture filters determine which packets are collected, while display filters determine which collected packets are shown. A packet capture is more detailed than a socket list, but it does not guarantee that application payloads will be readable: visibility depends on what reaches the chosen interface, and encrypted traffic remains encrypted.
Keep capture files private
Captures can expose sensitive information. Depending on how they are collected and what traffic is present, files may reveal command-line arguments or user paths. Restrict access to a capture and avoid sharing it unless you have reviewed what it contains.
Best Value
- 【Cable Tracing & Port Finder】FNIRSI LPM-10A wire tracer electrical & ethernet cable tracer quickly locates Ethernet cables & identifies active ports. Adjustable sensitivity makes this cable toner & wire toner perform reliably in noisy, bundled cable environments.
- 【Cable Continuity & Crimp Test】Professional ethernet tester checks RJ45 continuity, crimp quality, couplers & patch cords. Instantly diagnoses opens, shorts, miswires & faults for reliable network cable tester results.
- 【POE & Network Performance Test】This ethernet cable tester measures cable length, verifies 10/100/1000Mbps speed & auto-detects standard/non-standard POE. Ideal for cameras, APs & switches as a heavy-duty cable tester.
- 【NCV & Live Wire Detection】Built-in non-contact voltage test for safe on-site use. This versatile wire tester & network tester alerts to live AC wires, lowering shock risks while tracing or testing cables.
- 【Jobsite Ready Design】Rechargeable transmitter & receiver, low-battery alert & built-in flashlight. Portable ethernet toner and probe kit designed for long shifts & dark wiring spaces.
What a local capture can—and cannot—see
A capture records traffic that reaches the selected interface, subject to the hardware, driver, and interface support. On a switched network, enabling promiscuous mode does not normally make unrelated unicast traffic from other switch ports appear on your PC. Your interface generally sees its own unicast traffic and relevant broadcast or multicast traffic, not every conversation between devices on the LAN. Network topology therefore limits what a local capture can establish.
Choose the lightest tool that answers the question
| Tool | Best question to ask | Time view | What it reveals |
|---|---|---|---|
ss |
What sockets are open, and what process uses them? | Snapshot | Socket state, endpoints, and process associations when available. |
lsof -i |
Which command or PID owns an Internet socket? | Snapshot | Open Internet sockets associated with local processes. |
iftop |
Which network flows are using bandwidth now? | Live display | Traffic rates on an interface. |
nethogs |
Which process is using bandwidth now? | Live display | Live bandwidth use associated with processes. |
tcpdump, TShark, or Wireshark |
What packets and protocols are visible at this interface? | Live capture or saved trace | Packet-level detail, limited by permissions, interface support, and network visibility. |
For most troubleshooting, start with ss or lsof, move to a bandwidth view if you need to catch ongoing use, and capture packets only when protocol-level evidence is necessary. Process visibility can require privileges, snapshots can miss brief connections, and a trace can contain sensitive metadata.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
