Perhaps too late, I found out that the netstat command has been superceded by the ss command. This blog post talks about other commands that are also obsolete/deprecated. Thought other folks might want to know.
I used netstat for the longest time but switched to ss after netstat had me chasing my tail over a connection "that didnt exist", ss ended up showing it while netstat did not.
also i did not see mention of using nftables instead of ipset or iptables