Post #1384967

You can do “ss -aepni” and that will dump literally everything ss can get its hands on. Also, ss can’t find everything, it does have some limitations. I believe ss can only see what the kernel can see(host connections), but tcpdump can see the actual network flow on the network layer side. So incoming, outgoing, hex(?) data in transit, etc. I usually try to use ss first for everything since I don’t think it requires sudo access for the majority of its functionality, and if it can’t find something then I bring out sudo tcpdump.