43 Socket Statistics with SS
Socket Statistics with `ss`
`ss` (socket statistics) is a command-line utility in Linux used to investigate sockets. It provides detailed information about network connections, similar to `netstat`, but with improved performance and more features. `ss` is part of the `iproute2` package and is generally preferred over `netstat` for examining socket statistics.
Key Features of `ss`
1. **Display Active Connections**: Shows both TCP and UDP connections, including their states.
2. **View Listening Sockets**: Lists sockets that are actively listening for incoming connections.
3. **Show Detailed Socket Information**: Provides in-depth information about each socket, including processes associated with the connections.
4. **Filter Results**: Supports various filters to narrow down the output based on criteria like protocol, state, and more.
Commonly Used `ss` Options
Here are some commonly used options with `ss`:
`-a`: Displays all sockets (listening and non-listening).
`-t`: Displays only TCP sockets.
`-u`: Displays only UDP sockets.
`-l`: Shows listening sockets only.
`-n`: Displays numerical addresses instead of resolving hostnames.
`-p`: Shows the process using the socket.
`-s`: Displays summary statistics for sockets.
`-r`: Resolves service names.
Examples of Using `ss`
#### *1. Display All Active Connections*
```bash
ss -a
```
This command shows all active TCP and UDP connections, along with their states.
#### *2. Show Listening Sockets*
```bash
ss -l
```
This command lists all sockets that are currently listening for incoming connections.
#### *3. Display TCP Connections Only*
```bash
ss -t
```
This command filters the output to show only TCP connections.
#### *4. Show UDP Connections Only*
```bash
ss -u
```
This command displays only UDP connections.
#### *5. Show Numerical Addresses*
```bash
ss -n
```
Using this option prevents `ss` from resolving hostnames, displaying IP addresses instead. This is useful for performance when DNS resolution is slow.
#### *6. Show Process IDs and Program Names*
```bash
ss -p
```
This command displays the process ID and name of the program associated with each socket.
#### *7. Display Summary Statistics*
```bash
ss -s
```
This command provides a summary of socket usage, including the number of connections in various states (e.g., established, time-wait).
#### *8. Filter by State*
To display only established connections:
```bash
ss -t state established
```
This command filters the output to show only TCP connections that are currently established.
Conclusion
`ss` is a powerful and efficient tool for examining socket statistics in Linux. Its ability to filter and provide detailed information makes it a valuable resource for network troubleshooting and monitoring. If you have specific questions about using `ss` or need assistance with a particular scenario, feel free to ask!