Netstat and ss show socket states as tracked by the kernels network stack, not conntrack state within netfilter. The output may look similar however conntrack states may be around shorter or longer depending on sysctl settings, packets received or lost and would determine if connections are permitted as valid or dropped as being invalid, out of state or blocked due to the state table being full and a myriad of other conditions that affect connection state.
