How to Use the ss and ip Commands in Linux for Advanced Socket Statistics and Routing Configuration

In modern Linux administration, legacy networking tools from the deprecated net-tools suite—such as netstat, ifconfig, route, and arp—have been completely superseded by the iproute2 package. The net-tools utilities rely on parsing legacy procfs pseudofiles (/proc/net/dev, /proc/net/tcp), which introduces severe performance bottlenecks and memory overhead on systems managing tens of thousands of concurrent connections. Furthermore, net-tools cannot manipulate modern Linux kernel features such as multi-table policy routing, network namespaces, or WireGuard interfaces.

The iproute2 suite communicates directly with the kernel using bidirectional Netlink sockets. Within this suite, ss (Socket Statistics) provides high-performance socket inspection and TCP diagnostic extraction, while ip serves as the unified Swiss Army knife for interface management, address assignment, neighbour resolution, and routing policy configuration.

---

Architectural Advantages: Netlink vs Procfs

When an administrator invokes netstat on a server with 50,000 active TCP connections, the command locks kernel tables and parses massive plain-text buffers line by line. In contrast, ss leverages the kernel’s NETLINK_INET_DIAG subsystem, transferring binary diagnostic structures directly into user space. This enables sub-second inspection even during massive distributed denial-of-service (DDoS) events or heavy micro-service mesh traffic.

Legacy Utility (net-tools)	Modern Replacement (iproute2)	Kernel Communication Interface	Modern Capabilities
ifconfig [interface]	ip link / ip addr	Netlink (RTM_NEWLINK, RTM_NEWADDR)	Namespaces, VLAN tagging, VXLAN, MTU clamping
route -n	ip route / ip rule	Netlink (RTM_NEWROUTE, RTM_NEWRULE)	Multi-table policy routing, multipath routing, BGP routes
arp -an	ip neigh	Netlink (RTM_NEWNEIGH)	IPv4 ARP and IPv6 Neighbour Discovery (NDP)
netstat -tulpn	ss -tulpn	Netlink (INET_DIAG_REQ_V2)	Real-time TCP buffer inspection, RTT, congestion pacing

---

Mastering Socket Statistics with the ss Utility

The ss command dumps detailed socket metrics. It is primarily used to identify listening ports, trace connection states, and inspect low-level TCP performance indicators.

Step 1: Inspecting Listening and Active Sockets

To inspect active network daemons and verify which processes are bound to physical or loopback interfaces, execute:

# Display all listening TCP and UDP sockets with Process IDs and numeric ports
sudo ss -tulpn

# Display a statistical summary of socket types currently active in the kernel
ss -s

Common flag definitions include:

• -t: Filter for TCP sockets
• -u: Filter for UDP sockets
• -l: Display exclusively listening sockets (default is established/active)
• -p: Show the process name and PID holding the socket (requires sudo)
• -n: Do not resolve service names (displays numeric ports like 443 instead of https)
• -a: Display all sockets (both listening and non-listening)

Step 2: Filtering Sockets by State and CIDR Range

One of the most powerful capabilities of ss is its native state and address filtering engine. You do not need to pipe output into grep or awk.

# Filter for all TCP sockets in the TIME-WAIT or CLOSE-WAIT state
ss -t state time-wait
ss -t state close-wait

# Filter for connections targeting a specific subnet on HTTPS
ss -t '( dport = :https and dst 192.168.1.0/24 )'

# Filter for inbound connections originating from a specific IP on SSH
ss -t '( sport = :ssh and src 10.0.0.15 )'

Step 3: Extracting Deep TCP Diagnostics (Congestion & RTT)

When troubleshooting network latency, bufferbloat, or throughput degradation between nodes, use the -i (internal TCP info) and -m (memory) switches:

# Inspect internal TCP metrics including RTT, congestion window, and pacing
ss -ti '( dport = :https )'

The output returns granular kernel socket variables:

ESTAB  0  0  192.168.1.50:54322  104.21.45.10:443
   cubic wscale:7,7 rto:204 rtt:4.12/0.85 ato:40 mss:1460 rcvspace:131072
   snd_cwnd:10 ssthresh:7 bytes_acked:18432 segs_out:16 segs_in:14

Key metrics returned include:

• rtt:4.12/0.85: Smoothed round-trip time (4.12 ms) and mean deviation (0.85 ms).
• snd_cwnd:10: Current sender congestion window in packets.
• cubic / bbr: Active TCP congestion control algorithm.
• rcvspace: Active TCP receive buffer allocation in bytes.

---

Configuring Interfaces, Addresses, and Routing with the ip Utility

The ip command follows a predictable object-oriented command structure: ip [OPTIONS] OBJECT COMMAND [ARGUMENTS], where primary objects include link (L2 interfaces), addr (L3 IP addresses), route (routing table), and neigh (ARP/neighbour table).

Managing Network Interfaces (L2 – ip link)

Inspect physical, virtual, and bridge interfaces or alter interface states:

# List all available network interfaces with MAC addresses and status flags
ip link show

# Bring an interface administratively up or down
sudo ip link set dev eth0 down
sudo ip link set dev eth0 up

# Configure a custom Maximum Transmission Unit (MTU) for Jumbo Frames
sudo ip link set dev eth0 mtu 9000

# Rename a network interface (must be down first)
sudo ip link set dev eth0 name lan0

Configuring IP Addresses (L3 – ip addr)

Unlike ifconfig, which required secondary virtual aliases (e.g. eth0:1) for multi-homing, the Linux kernel natively supports multiple IP addresses per interface:

# Inspect IPv4 and IPv6 addresses assigned to all interfaces
ip addr show

# Add a primary or secondary IPv4 address with subnet mask
sudo ip addr add 192.168.1.150/24 dev eth0

# Remove an assigned IP address
sudo ip addr del 192.168.1.150/24 dev eth0

# Flush all IP addresses from an interface during network reconfiguration
sudo ip addr flush dev eth0

Managing the Routing Table (ip route)

The routing engine dictates the next-hop gateway for outbound IP packets:

# Inspect the kernel IPv4 routing table
ip route show

# Add a default gateway for internet access
sudo ip route add default via 192.168.1.1 dev eth0

# Add a static route to an isolated internal subnet
sudo ip route add 10.50.0.0/16 via 192.168.1.254 dev eth0

# Delete an existing static route
sudo ip route del 10.50.0.0/16

# Test route lookup: determine which interface and gateway a packet will use
ip route get 8.8.8.8

Running ip route get [IP] performs an immediate kernel routing lookup, revealing the exact source IP, gateway, interface, and MTU that will be applied without transmitting an actual payload.

Inspecting and Flushing Neighbour ARP Tables (ip neigh)

To inspect physical hardware addresses resolved on the local network segment:

# Display the local ARP / Neighbour Discovery cache
ip neigh show

# Manually add a static ARP binding (preventing ARP spoofing)
sudo ip neigh add 192.168.1.1 lladdr 00:11:22:33:44:55 dev eth0 nud permanent

# Flush stale ARP entries following a gateway or hardware replacement
sudo ip neigh flush all

---

Advanced Implementation: Policy-Based Routing (PBR)

Standard Linux routing evaluates exclusively the destination IP address. Policy-Based Routing (PBR) enables administrators to route traffic based on source IP, interface, or firewall mark (fwmark) by employing multiple discrete routing tables.

# Step 1: Create a dedicated routing table named 'secondary_isp'
# Add entry '200 secondary_isp' to /etc/iproute2/rt_tables if persistent

# Step 2: Populate the custom routing table with default route
sudo ip route add default via 10.0.0.1 dev eth1 table 200

# Step 3: Define a routing rule: traffic originating from 192.168.2.50 uses table 200
sudo ip rule add from 192.168.2.50/32 table 200

# Step 4: Verify active policy routing rules and priorities
ip rule show

---

Troubleshooting Common Linux Networking Faults

Observed Fault	Root Cause	Diagnostic & Remediation Step
Socket exhaustion / service cannot accept new connections	Thousands of closed connections lingering in TIME-WAIT state	Check count: ss -s. Enable TCP socket reuse in sysctl: sudo sysctl -w net.ipv4.tcp_tw_reuse=1.
ss -p fails to display process names or PIDs	Executing as unprivileged user; kernel restricts cross-user process audit	Prefix command with sudo. Linux kernel security policies require CAP_NET_ADMIN to read peer socket PIDs.
Traffic blackholing or asymmetric return path failure	Reverse Path Filtering (rp_filter) dropping unexpected interface ingress	Inspect sysctl: sysctl net.ipv4.conf.all.rp_filter. When using multiple routing tables, set rp_filter=2 (loose mode).
IP address configured via ip addr add disappears after reboot	iproute2 commands manipulate running kernel state directly in memory	Persist configuration within distribution network managers (e.g. Netplan on Ubuntu: /etc/netplan/*.yaml or NetworkManager: nmcli).

---

Governance and Modern Administration Standards

• Remove Legacy Scripts: Audit legacy automation scripts and CI/CD pipelines to replace invocations of ifconfig, route, and netstat with modern ip and ss equivalents to avoid deprecated package dependencies on minimal container base images.
• Automate Diagnostic Captures: For production incidents involving connection spikes, capture timestamped socket states using ss -tulpn > socket_dump.log and ip route show table all > route_dump.log before restarting services.
• Leverage Netlink Namespaces: Combine ip netns with ip link when testing micro-segmentation or container networking locally without provisioning full virtual machines.