Mastering `ss`: The Ultimate Utility to Investigate Sockets in Linux

Table of Contents#

1. Introduction to ss
2. Installation
3. Basic Usage & Output Interpretation
4. Filtering & Advanced Options
5. Common Use Cases
6. Best Practices
7. Troubleshooting with ss
8. Comparison with netstat
9. Conclusion
10. References

1. Introduction to ss#

The ss utility provides detailed insights into:

• TCP/UDP sockets: State (e.g., ESTABLISHED, LISTEN, TIME_WAIT), traffic queues, and connection details.
• UNIX domain sockets: Used for inter-process communication (IPC) on the same host.
• Network namespaces: Isolate network stacks (e.g., in containers or virtual environments).

Key advantages over netstat:

• Speed: Directly queries the kernel via Netlink (faster than netstat’s /proc parsing).
• Feature depth: Exposes TCP internals (e.g., congestion window, RTT, timestamps) and advanced filtering.

2. Installation#

ss is part of the iproute2 package (a modern networking toolkit for Linux). Install it with:

On Debian/Ubuntu:#

sudo apt update && sudo apt install iproute2

On RHEL/CentOS/Rocky Linux:#

sudo yum install iproute2  # or `dnf install iproute2` for newer versions

3. Basic Usage & Output Interpretation#

Listing All Sockets#

To view all active sockets (TCP, UDP, UNIX, etc.):

ss

Output Columns (Example for TCP):#

Filter by Socket Type#

• TCP sockets: ss -t
• UDP sockets: ss -u
• UNIX sockets: ss -x
• Listening sockets (add -l): ss -tl (TCP listening) or ss -ul (UDP listening)

Example: List All Listening TCP Ports#

ss -tl

Output (simplified):

State       Recv-Q Send-Q Local Address:Port  Peer Address:Port
LISTEN      0      4096   *:ssh               *:*
LISTEN      0      100    127.0.0.1:smtp      *:*
LISTEN      0      4096   :::http             :::*

4. Filtering & Advanced Options#

ss excels at precise filtering using keywords, ports, IPs, and socket states.

Filter by Socket State#

Common states: ESTABLISHED, LISTEN, TIME_WAIT, SYN_SENT, CLOSE_WAIT.

Example: Show only ESTABLISHED TCP connections:

ss -t state established

Filter by Port#

• Source port: ss -t sport = :22 (TCP, source port 22)
• Destination port: ss -t dport = :80 (TCP, destination port 80)

Filter by IP Address#

• Local IP: ss -t dst 192.168.1.100 (connections to 192.168.1.100)
• Remote IP: ss -t src 8.8.8.8 (connections from 8.8.8.8)

Filter by Address Family#

• IPv4 only: ss -t4
• IPv6 only: ss -t6

Show Process Info (-p)#

Requires root (or CAP_NET_ADMIN capability) to display the process using the socket:

sudo ss -tp state established

Output (simplified):

ESTAB      0      0      192.168.1.5:ssh       10.0.0.2:54321   users:(("sshd",pid=1234,fd=3))

Disable DNS Resolution (-n)#

For faster output (avoids reverse DNS lookups):

ss -tn state established

Show Timer Info (-o)#

Displays TCP timer details (e.g., retransmit, keepalive):

ss -to state established

Show Summary Statistics (-s)#

Print a count of sockets by protocol and state without listing individual sockets:

ss -s

5. Common Use Cases#

1. Check Open (Listening) Ports#

To list all TCP and UDP listening ports (numeric, no DNS):

ss -tuln

Output (simplified):

Netid State  Recv-Q Send-Q Local Address:Port  Peer Address:Port
tcp   LISTEN 0      4096   *:22                *:*
tcp   LISTEN 0      100    127.0.0.1:25        *:*
udp   LISTEN 0      4096   *:53                *:*

2. Find Which Process Uses a Port#

To identify the process behind port 80 (HTTP):

sudo ss -tulnp | grep :80

Output:

tcp   LISTEN 0      4096   *:80   *:*    users:(("nginx",pid=5678,fd=6))

3. Monitor Established SSH Connections#

Show all active SSH (port 22) connections:

ss -t state established '( sport = :22 )'

4. Quick Socket Summary#

Get a high-level overview of socket counts by protocol and state:

ss -s

Output (example):

Total: 312
TCP:   14 (estab 4, closed 3, orphaned 0, timewait 3)

Transport Total  IP   IPv6
RAW       1      0    1
UDP       6      4    2
TCP       11     7    4
INET      18     11   7

This is useful for a quick health check on busy servers.

5. The All-in-One Shortcut: ss -tulpn#

A practical one-liner for daily use that lists all TCP and UDP listening sockets with process names and numeric ports:

ss -tulpn

Output (example):

Netid State  Recv-Q Send-Q Local Address:Port  Peer Address:Port  Process
tcp   LISTEN 0      128    0.0.0.0:22          0.0.0.0:*          users:(("sshd",pid=1234,fd=3))
tcp   LISTEN 0      511    0.0.0.0:80          0.0.0.0:*          users:(("nginx",pid=5678,fd=6))
udp   UNCONN 0      0      0.0.0.0:68          0.0.0.0:*          users:(("dhclient",pid=910,fd=6))

6. Analyze TCP Connection Details#

To view TCP options (e.g., window size, RTT) for a specific connection:

ss -ti dst 10.0.0.2

Output (simplified):

ESTAB      0      0      192.168.1.5:ssh       10.0.0.2:54321
 cubic wscale:7,7 rto:204 rtt:0.5/0.25 ato:40 mss:1448 cwnd:10
 ssthresh:7 bytes_sent:3288 bytes_acked:3289 send 231.7Mbps

6. Best Practices#

1. Prefer ss Over netstat#

netstat is deprecated in many distributions. ss is faster, more feature-rich, and actively maintained.

2. Combine Filters for Precision#

Use logical operators (e.g., dst, sport, state) to narrow down results:

ss -t state established dst 192.168.1.0/24

3. Scripting: Use -n and Consistent Formats#

For automation, disable DNS lookups (-n) and use --json (for JSON output) or --csv (for CSV):

ss -tn --json | jq '.sockets[] | select(.state == "ESTABLISHED")'

ss -tn --csv

For a quick socket count in scripts, use ss -s (summary mode) which avoids parsing large socket lists.

4. Limit Scope with Namespaces#

To analyze sockets in a Docker container (via its network namespace):

sudo nsenter -n -t $(docker inspect -f '{{.State.Pid}}' my-container) ss -tuln

7. Troubleshooting with ss#

1. High Recv-Q (Backlog)#

A large Recv-Q means the application is not reading data fast enough (e.g., a slow database or misconfigured service).

Check:

ss -tnp state established 'Recv-Q > 0'

2. High Send-Q (Transmission Queue)#

A large Send-Q suggests:

• Network congestion (e.g., bandwidth saturation).
• The remote peer is not acknowledging data (e.g., firewall drops, or peer is overloaded).

Check:

ss -tnp state established 'Send-Q > 0'

3. SYN_RECV Flood (SYN Attacks)#

A surge in SYN_RECV sockets may indicate a SYN flood (DDoS) or misconfigured backlog:

ss -t state syn-recv | wc -l

Tune net.ipv4.tcp_max_syn_backlog (e.g., sysctl -w net.ipv4.tcp_max_syn_backlog=1024).

4. Excessive TIME_WAIT Sockets#

TIME_WAIT is normal (connections waiting to close), but too many can exhaust ports.

Check:

ss -t state time-wait | wc -l

Tune (with caution):

• net.ipv4.tcp_tw_reuse=1 (reuse TIME_WAIT sockets for new connections).
• Note: net.ipv4.tcp_tw_recycle was removed in Linux kernel 4.12 (2017) because it broke connections behind NAT. Do not use it.

8. Comparison with netstat#

9. Conclusion#

The ss utility is an indispensable tool for Linux network analysis. Its speed, advanced filtering, and deep kernel integration make it ideal for troubleshooting connections, identifying port conflicts, and diagnosing performance issues. By mastering ss, you’ll gain a powerful ally in debugging complex network problems.

10. References#

• ss man page: man ss (or online)
• iproute2 documentation: iproute2 — Wikipedia
• Linux Kernel Netlink: Netlink Handbook
• TCP Tuning: Red Hat — Tuning Network Performance

Use ss to unlock deep insights into your Linux system’s network behavior. Experiment with its options, and let it become your go-to tool for network troubleshooting! 🛠️