ss and socket state - inspecting TCP and UDP from the kernel

ss (socket statistics) reads the kernel’s socket tables directly through netlink. It replaced netstat and is the primary tool for “what is listening, what is connected” on a modern Linux host.

The basic options

ss                  # all sockets (default: ESTABLISHED)
ss -a               # all sockets in any state
ss -l               # listening only
ss -t               # TCP only
ss -u               # UDP only
ss -x               # Unix domain sockets only
ss -w               # raw sockets
ss -n               # no name resolution (show IPs/ports numeric)
ss -p               # show process info
ss -s               # summary statistics

The flags combine. ss -tlnp means “TCP, listening, numeric, with process info” - the canonical “what is listening” check.

Common recipes

# What is listening
ss -tlnp

# What is connected
ss -tnp state established

# Connections to/from a specific host
ss -tn dst 10.0.0.5

# Connections to a specific port
ss -tn 'sport = :443'

# Time-wait accumulation
ss -tan state time-wait | wc -l

# Established count
ss -tan state established | wc -l

# All states for a process
ss -tnp 'pid = 1234'

# Summary statistics (good for dashboards)
ss -s

Reading the output

State      Recv-Q Send-Q  Local Address:Port   Peer Address:Port
LISTEN     0      128           0.0.0.0:443         0.0.0.0:*
ESTAB      0      0      10.0.0.10:443     10.0.0.5:51234
TIME-WAIT  0      0      10.0.0.10:443     10.0.0.6:49812

• State: TCP state (LISTEN, ESTABLISHED, TIME-WAIT, etc.). UDP sockets show UNCONN.
• Recv-Q: bytes the application has not read from the receive buffer. Non-zero on ESTABLISHED = the application is not draining its socket; investigate.
• Send-Q: bytes queued to send but not yet ACKd. Non-zero = the remote is slow or the network is congested.
• Local Address: the local end (IP:port). 0.0.0.0 / [::] = “all interfaces”.
• Peer Address: the remote end.

The local-address column is not decoration

On a LISTEN line, the address half of Local Address:Port is the single most misread field in the output. Four sockets, all on port 8080, with four different reachability:

LISTEN 0 4096   127.0.0.1:8080   users:(("api",pid=911,fd=6))  # this host only
LISTEN 0 4096     0.0.0.0:8080   users:(("api",pid=911,fd=6))  # every IPv4 address
LISTEN 0 4096        [::]:8080   users:(("api",pid=911,fd=6))  # every address
LISTEN 0 4096   10.0.0.10:8080   users:(("api",pid=911,fd=6))  # that one address

Every TCP state

Spotting trouble

A non-zero Recv-Q on ESTABLISHED connections is the most common sign of trouble:

ss -tnp | awk 'NR>1 && $2 > 0'

This prints every TCP socket with bytes in the receive buffer the application has not read. If many sockets show non-zero Recv-Q, the application is slow or stuck.

CLOSE-WAIT accumulation:

ss -tan state close-wait | wc -l

CLOSE-WAIT means the remote side closed the connection (sent FIN) and the kernel ACKd it, but the local application has not called close(). This is an application bug or a slow application. Sustained CLOSE-WAIT growth is a problem to escalate.

SYN-SENT growth:

ss -tan state syn-sent | wc -l

SYN-SENT means the local side sent SYN and is waiting for a SYN-ACK. If a host has many SYN-SENT connections to the same target, either the target is down, a firewall is dropping SYN, or there is no listener.

Comparing ss to netstat

netstat is deprecated and slow. The mapping is:

If you find an old recipe using netstat, the ss form is usually a one-character difference.

Knowledge check