iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Start with ss -tunap to see TCP and UDP sockets and, where permissions allow, the local processes using them. Use lsof to tie open Internet sockets to commands, a bandwidth monitor to spot active transfers, and packet capture only when you need to inspect traffic in more detail. These tools answer different questions; none guarantees a view of every device or every application’s activity.
See active sockets and the processes using them
ss is a quick first check. It reports socket information, including TCP and UDP connections, and can show listening sockets or process associations. The ss(8) manual documents its filters and examples.
ss -tunaprequests numeric TCP and UDP sockets across all states, plus process information.ss -lntupnarrows the view to listening TCP and UDP sockets.ss -tanp state establishedshows established TCP sessions and requests process details.
If process names or PIDs are missing, try an appropriately privileged run, such as sudo ss -tunap. The details available depend on your permissions. Check ss --help or the installed man page if an option or output differs on your system; flags and presentation can vary by iproute2 version.
For a process-oriented list of Internet sockets, run sudo lsof -i -n -P. The lsof project tutorial describes how -i can be qualified by protocol, host, address, or port. The -n and -P options suppress name and service lookups, so endpoints appear as numeric addresses and ports.
#1 Best Overall
- VERSATILE CABLE TESTING: Cable tester tests voice (RJ11/12), data (RJ45), and video (coax F-connector) terminated cables, providing clear results for comprehensive testing on unenergized Ethernet cables (not designed to test PoE)
- EXTENDED CABLE LENGTH MEASUREMENT: Measure cable length up to 2000 feet (610 m), allowing for precise cable length determination
- COMPREHENSIVE FAULT DETECTION: Test for Open, Short, Miswire, or Split-Pair faults, ensuring thorough fault detection and identification
- BACKLIT LCD DISPLAY: Backlit LCD screen displays cable length, wiremap, cable ID, and test results, ensuring easy readability in various lighting conditions
- EFFICIENT CABLE TRACING: Trace cables, wire pairs, and individual conductor wires using the multiple style tone generator (requires analog probe Cat. No. VDV500-123, sold separately), simplifying cable tracing tasks
These commands take snapshots. A brief connection can start and end between checks; for intermittent activity, repeat the command or use a live monitor. A process name identifies software running on your PC, while a remote IP address and port identify a network endpoint—not necessarily a recognizable service or its purpose.
Watch which flows or processes are using bandwidth
Socket listings tell you about connections; they do not show how much data each is moving right now. iftop provides a live view of flows on a network interface, while nethogs focuses on bandwidth use by process. Debian’s network diagnosis overview describes interface-level monitoring and packet-analysis tools.
Rank #2
- Cable Performance testing up to 10GBASE-T via frequency-based measurements
- Network features including: IPv4 and v6 ping, nearest switch diagnostics (IP address, name, port / VLAN number, and advertised data rates)
- Ethernet Alliance certified PoE Verification – Detects the PoE class (1-8) and power, and performs a load test of available PoE from the connected switch
- Displays cable length, wire map, and distance to open or short
- Manage results and print reports from LinkWare PC
Use a bandwidth view when you have noticed a transfer or slowdown and want to identify which flow or process is consuming the link. It complements rather than replaces ss or lsof: a rate display highlights current activity, while socket listings provide endpoint and process details. Package names, availability, and command options vary by distribution, so consult your distribution’s documentation before installing or relying on a particular invocation.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Capture packets when endpoint lists are not enough
When you need to examine individual packets or protocol details, tcpdump is a common command-line capture tool. TShark provides terminal-based Wireshark analysis; Wireshark offers a graphical view and can analyze both live traffic and saved capture files. The Wireshark manual page explains capture and display filters, and Debian’s network diagnosis overview covers these tools.
Rank #3
- Multifunctional NOYAFA NF-8508 Network Cable Tester: There are nine features to meet your needs. Continuity Testing, Cable Scan, Port Flash, Length Measurement, POE Power Supply Test, QC testing, Optical Power Meter, VFL and NVC function.It is perfectly suited for various engineering cabling projects, network troubleshooting, network equipment maintenance and testing scenarios. Its precise cable scanning and fault localization capabilities help you effortlessly pinpoint the root cause of issues.
- 7 WAVELENGTHS OPTICAL POWER METER: NF-8508 network cable tester can measure 7 standard wavelengths, 850/1300/1310/1490/1550/1625/1650, power detecting range(dBm): -70 ~ +10. Its power detection range spans from -70 dBm to +10 dBm, supporting FC/SC/ST connectors. It enables precise fiber optic power measurement, helping users efficiently assess fiber signal strength and ensure healthy fiber link operation. It effortlessly detects attenuation issues within fibers, thereby safeguarding fiber network stability.
- High Efficiency Visual Fault Locator: Easy identification of fiber breakpoints, poor connections, bending or cracking. Excellent for finding the right fiber to splice or quickly finding a break. Emmiting Energy: standard wavelenth: 650nm. Fast flashing, slow flashing, high precison.The built-in self-calibration ensures stable long-term performance, and Class IIIa laser (output<5mW) ensures safe daily operation.
- PORT FLASHING:The indicator light on the connection port in the NF-8508 device flashes to help accurately locate the cable. Displays port information, including operating speed, duplex mode, and negotiation settings. Port lights flash on the same screen to show the port's operating speed, making it easy to pinpoint lines and ports.
- PoE Testing and Cable Length Test: PoE testing can check cable mapping polarity and voltage of PoE network switches, withstand 60VDC. Automatically detects and switches between 10M/100M/1000M modes, Includes cable tracking, short circuit test, interruption of circuit test and etc The RJ45 cable tester can quickly measure the length of the cable with a range of 200m. Not only network cables, but also phone lines and BNC cables.
Keep a capture narrow and short: choose the relevant interface, apply a suitable capture filter, and retain only what you need. Capture filters determine what is collected; display filters help select packets from traffic already captured. Consult the tool’s documentation for filter syntax and permissions on your system.
Packet capture is not a guarantee that you will see all application activity or readable message contents. The packets available depend on the selected interface, its hardware and driver support, permissions, and network topology. Encryption can also mean that captured application data is not readable as plain text.
Rank #4
- VERSATILE CABLE TESTING: Cable tester for data (RJ45) terminated cables and patch cords, ensuring comprehensive testing capabilities
- LARGE BACKLIT LCD: Backlit LCD display enables easy reading of pin-to-pin wiremap results, even in low-lit areas
- COMPREHENSIVE FAULT DETECTION: Test for Open, Short, Miswire, Split-Pair faults, Cross-over, and Shield, providing thorough fault detection
- INTUITIVE USER INTERFACE: User-friendly interface with three buttons and simple, easy-to-identify test responses, ensuring a smooth testing experience
- MULTIPLE TONE GENERATOR STYLES: Tone on a single wire, wire pair, or all 8 conductor wires using the multiple style tone generator (solid/warble); requires probe Cat. No. VDV500-123 (sold separately)
Know what a local capture can see
A capture sees traffic that reaches the chosen interface. On a typical switched network, your computer’s port receives its own unicast traffic and relevant broadcast or multicast traffic—not arbitrary unicast traffic exchanged between other devices. Enabling promiscuous mode does not normally make a switch send unrelated traffic to your port. The Wireshark FAQ explains this limitation and notes that interface and hardware support matter.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minutePacket traces can contain sensitive information. The Wireshark User’s Guide notes that capture process metadata has limits: privileges affect what can be associated with traffic, and very short-lived sockets may be missed. A trace may also expose command-line arguments or user paths when shared, so review it before sending or publishing it.
Best Value
- 【Cable Tracing & Port Finder】FNIRSI LPM-10A wire tracer electrical & ethernet cable tracer quickly locates Ethernet cables & identifies active ports. Adjustable sensitivity makes this cable toner & wire toner perform reliably in noisy, bundled cable environments.
- 【Cable Continuity & Crimp Test】Professional ethernet tester checks RJ45 continuity, crimp quality, couplers & patch cords. Instantly diagnoses opens, shorts, miswires & faults for reliable network cable tester results.
- 【POE & Network Performance Test】This ethernet cable tester measures cable length, verifies 10/100/1000Mbps speed & auto-detects standard/non-standard POE. Ideal for cameras, APs & switches as a heavy-duty cable tester.
- 【NCV & Live Wire Detection】Built-in non-contact voltage test for safe on-site use. This versatile wire tester & network tester alerts to live AC wires, lowering shock risks while tracing or testing cables.
- 【Jobsite Ready Design】Rechargeable transmitter & receiver, low-battery alert & built-in flashlight. Portable ethernet toner and probe kit designed for long shifts & dark wiring spaces.
Choose the tool for the question
| Tool | Best for | Time view | What it does not provide by itself |
|---|---|---|---|
ss |
Socket states, endpoints, listening ports, and process associations | Snapshot | Bandwidth rates or packet contents |
lsof -i |
Open Internet sockets associated with processes | Snapshot | Bandwidth rates or packet contents |
iftop |
Current network flows and their activity | Live view | Which local process owns a connection in every setup, or decoded packet contents |
nethogs |
Which processes are using bandwidth | Live view | Protocol-level packet analysis |
tcpdump, TShark, or Wireshark |
Packet capture and protocol-level inspection | Live capture or saved trace, depending on tool and workflow | Traffic that does not reach the selected interface |
For most “what is this PC connected to?” questions, begin with ss and use lsof when you want another process-oriented view. Move to a bandwidth monitor to find what is active now; capture packets only when you need deeper protocol evidence and understand the visibility and privacy limits.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
