How to Use ss from iproute2 to Monitor Sockets in Linux Terminal

Modern Linux system administration relies heavily on the iproute2 toolkit, which modernizes kernel networking diagnostics by interacting directly with the Linux kernel’s sock_diag netlink subsystem. For decades, administrators relied on the venerable netstat utility to inspect open ports, listening sockets, and routing tables. However, on high-throughput servers handling tens of thousands of concurrent connections, netstat becomes excruciatingly slow because it parses raw files under the /proc/net/ filesystem. The ss (socket statistics) command delivers instantaneous socket dumps, granular memory usage metrics, and rich packet filtering directly through netlink.

Basic Syntax and Common Flag Combinations

The ss binary ships by default with the iproute2 package across Debian, Ubuntu, Fedora, RHEL, and Arch Linux. Running ss without arguments prints an unfiltered list of all established, non-listening connections across UNIX domain sockets, TCP, and UDP.

To inspect active listening ports and established network sessions, combine standard filtering flags:

# Display all listening TCP sockets with numerical port resolution
ss -tln

# Display all listening and established TCP and UDP sockets with resolving service names
ss -tuap

# Display UNIX domain listening sockets
ss -xl

• -t: Filter specifically for TCP sockets.
• -u: Filter specifically for UDP sockets.
• -l: Display only listening sockets (suppresses active established client sessions).
• -a: Display both listening and non-listening (connected) sockets.
• -n: Show numerical IP addresses and port numbers instead of resolving DNS hostnames and /etc/services port names (vastly speeds up output).
• -p: Display process IDs (PID) and program names associated with each socket (requires root or sudo privileges).

Displaying Process Information and Socket Memory

When troubleshooting application port conflicts or memory consumption, combining process identification with socket buffer analytics provides crucial insights:

# Show listening TCP ports along with process names and PIDs
sudo ss -tlpn

# Inspect socket memory buffer utilization (Receive/Send queues and buffer sizes)
sudo ss -t -m

In the memory output (-m), ss breaks down the kernel memory structures allocated to individual sockets:

• skmem: Summarizes total socket buffer allocations, including rmem_alloc (receive buffer currently consumed), rcv_buf (maximum window size allowed), wmem_alloc (transmit buffer queue), and snd_buf.
• Send-Q & Recv-Q: In listening state, Recv-Q indicates the number of connections waiting in the accept queue, while Send-Q shows the maximum backlog limit. For established TCP connections, non-zero values highlight network packet bottlenecks or slow application consumption.

Filtering Sockets by State and Network CIDR

One of the most powerful features of ss is its native state machine filtering and relational syntax, avoiding the need to pipe output into grep or awk:

# Filter TCP sockets strictly in the ESTABLISHED state
ss -t state established

# Filter sockets in TIME-WAIT or CLOSE-WAIT states
ss -t state time-wait
ss -t state close-wait

# Filter for connections directed to a specific IP or subnet
ss -t dst 192.168.1.0/24

# Filter for connections on a specific port range
ss -t '( sport = :http or sport = :https )'

# Display all established connections originating from a specific client IP
ss -t dst 10.0.0.50:443

Monitoring Sockets in Real Time with Watch

To continuously monitor live socket lifecycle transitions during stress testing or DDoS investigations, pair ss with the watch utility:

# Refresh socket statistics every second highlighting changes
watch -n 1 -d "ss -t -a 'sport = :443'"

By leveraging ss with native netlink socket queries, Linux administrators obtain immediate, low-overhead network visibility capable of scaling across production container environments and enterprise cloud servers.