ss replaced netstat and is considerably faster

netstat reads and parses /proc/net/* as text. On a box with thousands of connections that is slow enough to notice, and the tool has been deprecated in favour of ss, which asks the kernel directly over netlink.

ss -lptn                    # listening TCP, with process names
ss -tn state established    # established connections only
ss -tn 'dport = :3306'      # everything talking to MySQL
ss -s                       # summary counts by socket state

The filter syntax is the real gain: netstat meant piping through grep and hoping the columns lined up, whereas ss filters on state and port in the kernel. On many minimal images and containers net-tools is no longer installed at all, so netstat is simply absent and ss is what is there.