How to use the ss command to monitor TCP connections on Linux
Tired of netstat? Learn how to use the ss command to list TCP sockets, identify linked processes, and analyze network latency with superior performance.
Summary
- The ss command serves as the modern replacement for netstat, accessing kernel data directly for significantly faster results.
- Advanced socket filtering allows for precise isolation of connections based on specific states, ports, or IP addresses.
- Mapping processes to network ports is a critical step in diagnosing resource leaks and network performance bottlenecks.
- Using flags like -t, -u, and -n ensures focused output while preventing performance-draining DNS resolution lookups.
- Embedded TCP statistics provide deep insights into latency and connection health directly from the network stack.
Why switch from netstat to ss?
If you manage Linux systems, you've likely relied on netstat to check open ports. While it is a classic, it belongs to the obsolete net-tools package. The ss command (part of iproute2) is the modern standard, designed to extract information directly from the kernel's internal structures. In practice, this means ss can handle massive amounts of socket data without the performance penalty that often causes netstat to hang on busy servers.
Understanding the command syntax
The real power of ss lies in its ability to filter results at the source. To list all TCP connections, use ss -t. To speed things up, always add the -n flag to bypass numeric DNS resolution. If you need to see which process owns a connection, use the -p flag. It follows the same operational spirit as our guide on using the netstat command for network connections, but with a tool built for modern performance.
Filtering by connection state
Troubleshooting often involves hunting for connections in problematic states like SYN-RECV or TIME-WAIT. The ss tool makes this simple: ss -t state established returns only active, healthy connections. If your server is unresponsive, filtering by state is the first step to identifying socket exhaustion. Of course, network isn't the only culprit; if your services are crashing, check our article on how to diagnose OOMKill in Kubernetes to rule out memory issues.
Process mapping and latency
Knowing which process is hogging a port is essential for both security and maintenance. The command ss -tp displays the process ID (PID) alongside the network details. Even better, ss -ti reveals internal TCP metrics like RTT (Round Trip Time), which directly informs you about network congestion. These insights are vital for tuning your stack, just as you would when you limit Docker container memory using Cgroups v2 to ensure overall stability.
Conclusion
Switching to ss is a vital upgrade for any sysadmin looking to maintain efficient and observable Linux environments. Its speed and deep integration with the kernel make it an indispensable tool in your daily toolkit.
By mastering these flags, you gain the ability to spot network congestion and rogue processes instantly. Consistent monitoring is the foundation of a robust, high-availability infrastructure.