ss

Overview

The ss command is a utility to investigate sockets. It’s a modern replacement for netstat, providing detailed information about network connections.

Syntax

ss [options] [filter]

Common Options

Option	Description
`-n`	Don’t resolve names
`-r`	Resolve names
`-a`	All sockets
`-l`	Listening sockets
`-p`	Show processes
`-t`	TCP sockets
`-u`	UDP sockets
`-w`	RAW sockets
`-x`	Unix sockets
`-4`	IPv4 only
`-6`	IPv6 only
`-i`	Show TCP internal info
`-s`	Summary statistics

Key Use Cases

Network monitoring
Connection tracking
Socket analysis
Performance tuning
Troubleshooting

Examples with Explanations

Example 1: List Connections

ss -tuln

Show TCP/UDP listening ports

Example 2: Process Info

ss -tulnp

Show processes using sockets

Example 3: Connection Stats

ss -s

Show socket statistics

Understanding Output

Connection state flags: - LISTEN: Listening for connections - ESTAB: Established connection - TIME-WAIT: Connection terminating - CLOSE-WAIT: Remote end closed - SYN-SENT: Connection attempt - FIN-WAIT: Socket closed

Common Usage Patterns

Monitor TCP connections:
```
ss -tan state established
```
Check specific port:
```
ss -tulnp sport = :80
```
Memory usage:
```
ss -m
```

Performance Analysis

Connection states
Memory usage
Buffer sizes
Queue lengths
Timing information

Additional Resources

Best Practices

Regular monitoring
Performance baselines
Security checks
Documentation
Alert thresholds

Troubleshooting

Connection issues
Port conflicts
Memory problems
Process identification
Network bottlenecks

Socket States

Established
Listen
Time Wait
Close Wait
Syn Sent