The host is reachable but the app won’t connect. Is the service even listening? Is the port open? ss, netstat, and a raw TCP test answer in seconds.
Why: "connection refused" usually means the network is fine but the application is not actually listening on the expected port — checking the listening sockets confirms whether the server side is even up. When: run it on the server when a client cannot connect. Where: if the port is not listed, the service is down or bound to the wrong address/interface.
ss -tlnp # Linux: TCP (t) listening (l) sockets, numeric, PID
netstat -tlnp # older Linux
netstat -ano # Windows: all connections + owning PID
# Look for your port in LISTEN state, e.g.:
# LISTEN 0 128 0.0.0.0:443 users:(("nginx",pid=1200))
# Bound to 127.0.0.1 instead of 0.0.0.0? It only accepts LOCAL clients.Why: ping tests the host but not a specific port — a firewall can allow ICMP while blocking TCP 443, so you test the actual port to prove the application path end-to-end. When: after confirming the service listens, test reachability from the client. Where: a refused connection means something answered and said no; a timeout means a firewall silently dropped it.
# Test a specific TCP port from the client:
nc -zv example.com 443 # netcat: succeeds or reports refused/timeout
telnet example.com 443 # classic: connects, or hangs/refuses
curl -v https://example.com # full app-layer test incl. TLS handshake
# "refused" = something said no (service down / port closed)
# "timeout" = silently dropped (firewall / wrong path)Why: viewing established connections shows who a host is actually talking to and in what state, which uncovers exhaustion (too many connections), stuck sockets, or unexpected peers. When: use it to diagnose "the server is slow/unresponsive" or to spot suspicious outbound connections. Where: many sockets stuck in TIME_WAIT or CLOSE_WAIT points to an application not closing connections cleanly.
ss -tan # all TCP sockets and their states
ss -tan state established # only established connections
ss -s # summary counts by state
# TCP states to recognize:
# LISTEN waiting for connections
# ESTABLISHED active connection
# TIME_WAIT recently closed (normal in moderation)
# CLOSE_WAIT app hasn't closed its side (leak if it piles up)