Lesson 7 of 9 · 20m

ss and /proc/net: What Your Host Thinks Is Connected

Read the kernel's socket table: listeners, CLOSE-WAIT leaks, SYN-SENT stalls, and auditing for things you didn't deploy.