How to Use the ss and ip Commands in Linux for Advanced Network Socket and Routing Diagnostics

For decades, Linux systems administrators relied on the net-tools suite—specifically ifconfig, netstat, and route—to diagnose network interfaces, inspect listening ports, and manipulate routing tables. However, modern Linux kernels handle massive connection concurrency, containerized virtual networking, and multi-gigabit throughput that obsolete these legacy utilities. In high-traffic production environments with tens of thousands of simultaneous TCP connections, executing netstat causes severe latency because it parses line-by-line through pseudo-files in /proc/net/, locking kernel data structures. Modern Linux distributions replace net-tools with the iproute2 framework, anchored by ss (Socket Statistics) and ip. Utilizing kernel netlink interfaces and the sock_diag subsystem, these modern commands provide instantaneous socket telemetry, granular filter expressions, and deterministic routing diagnostics.

Comparing iproute2 (ss / ip) Against Legacy net-tools (netstat / ifconfig)

The transition from net-tools to iproute2 is not merely a syntax change; it represents an architectural shift in how user space queries the Linux kernel network stack. The table below outlines the core differences:

Operational Role	Legacy Command (Deprecated)	Modern Command (iproute2)	Architectural Advantage
Socket Telemetry	netstat -tulpn	ss -tulpn	Queries kernel sock_diag netlink directly; avoids slow /proc/net text scraping.
Interface Management	ifconfig eth0	ip link / ip addr	Supports multiple CIDR prefixes per interface, VLAN tagging, and bridge definitions natively.
Routing Table Inspection	route -n	ip route	Integrates policy routing, multiple routing tables, metric priorities, and VRF instances.
ARP / Neighbour Cache	arp -an	ip neigh	Audits IPv4 ARP and IPv6 Neighbor Discovery Protocol (NDP) state transitions in real time.

Mastering Socket Statistics with ss

The ss command extracts socket states, memory buffer allocations, and TCP window metrics directly from the kernel.

1. Auditing Listening Ports and Associated Processes

To inspect all listening TCP and UDP sockets along with their process names and PIDs:

sudo ss -tulpn

• -t: Display TCP sockets.
• -u: Display UDP sockets.
• -l: Filter strictly for listening sockets (omits established client sessions).
• -p: Display process name and PID owning the socket (requires root privileges).
• -n: Suppress numeric port-to-service resolution (renders 443 instead of resolving https).

2. Filtering by TCP Connection State

When diagnosing connection leaks or server port exhaustion, filter sockets by their specific TCP lifecycle state:

# List all actively established connections
ss -t state established

# Count connections stalled in TIME-WAIT
ss -t state time-wait | wc -l

# Detect client sockets trapped in CLOSE-WAIT (application failed to close socket)
ss -t state close-wait

3. Granular Address and Port Filtering

ss features a rich expression language that eliminates the need to pipe output into grep or awk:

# Filter for destination port 443 or source port 443
ss -t '( dport = :https or sport = :https )'

# Identify all connections originating from a specific subnet
ss -t dst 192.168.10.0/24

# Filter connections with unacknowledged data in send queues
ss -t 'sendq > 0'

4. Extracting Advanced TCP Diagnostics with -ti

To inspect internal TCP parameters—such as Round-Trip Time (RTT), congestion window size (cwnd), and retransmission counts—use the internal info switch:

ss -ti dst 10.0.0.5

The output reports granular network telemetry:

cubic wscale:7,7 rto:204 rtt:0.245/0.032 ato:40 mss:1460 rcvspace:14600 ssthresh:10 cwnd:10 retrans:0/1

This allows network engineers to verify whether packet latency is caused by network jitter or TCP congestion window collapse.

Managing Interfaces, Addresses, and Routing with ip

The ip command consolidates interface management, IP addressing, routing tables, and ARP caching under a unified syntax: ip [object] [command].

1. Quick Interface and Address Auditing

To view an overview of all active network interfaces and their assigned IP addresses without scrolling through pages of output:

ip -br addr

The -br (brief) flag renders a concise tabular summary:

lo              UNKNOWN        127.0.0.1/8 ::1/128
eth0            UP             192.168.1.150/24 fe80::5054:ff:fe12:3456/64
docker0         DOWN           172.17.0.1/16

2. Adding and Removing Ephemeral Secondary IP Addresses

To bind an ephemeral secondary IP address to an existing interface for service migration:

sudo ip addr add 192.168.1.200/24 dev eth0 label eth0:vip
sudo ip addr del 192.168.1.200/24 dev eth0

3. Auditing Link-Level Errors and Packet Drops

To check for physical cable faults, duplex mismatches, or ring buffer overruns, inspect link statistics:

ip -s link show dev eth0

Review the RX errors, dropped, and overrun counters. High dropped packet counts indicate incoming traffic is exceeding network driver processing capacity.

Diagnosing Routing Paths with ip route get

When a server possesses multiple network interfaces (e.g., dual NICs, local subnets, and an active VPN), determining which interface and source IP address the kernel selects for an outbound packet can be complex.

1. Testing Live Kernel Route Selection

Use ip route get to simulate route evaluation:

ip route get 8.8.8.8

The kernel evaluates its internal routing tables and returns the exact decision:

8.8.8.8 via 192.168.1.1 dev eth0 src 192.168.1.150 uid 1000
    cache

This proves unequivocally that traffic to 8.8.8.8 routes via gateway 192.168.1.1 over physical interface eth0 using local source address 192.168.1.150.

2. Auditing and Flushing the ARP / Neighbour Cache

If an upstream router or switch is replaced and your server maintains stale hardware MAC address mappings:

# Inspect the ARP/Neighbor cache
ip neigh show

# Flush the ARP cache across interface eth0
sudo ip neigh flush dev eth0

Troubleshooting Real-World Network Incidents

Combine ss and ip to resolve common infrastructure faults:

• Port Conflicts on Service Startup: When Nginx or Apache fails to start with Address already in use, identify the conflicting binary:

  sudo ss -tulpn | grep ":80\b"

• Diagnosing Socket Buffer Memory Saturation: If high-throughput microservices drop packets under peak loads, query memory buffers with ss -tm. Sockets displaying large skmem(r...,w...) values are exhausting allocated kernel TCP buffers (net.ipv4.tcp_rmem and net.ipv4.tcp_wmem).