Using ss Command to Troubleshoot Network Issues on Linux

Linux offers multiple tools for analyzing network statistics; ss is one of those command-line utilities. In this tutorial, we'll go through the fundamentals of the ss command with some easy examples.

ss Command

The Socket Statistics (ss) command in Linux displays network socket information. When used to dump socket statistics, the ss command presents data like that of netstat, but more quickly and simply.

With ss, you can view detailed information about the sockets that are being used by your system, including their state, source and destination addresses, and other related information. It can display much more TCP and status information than most other tools.

Following is the output of the ss command, which shows data in different columns. The ss command without any options list all open non-listening sockets (e.g. TCP/UNIX/UDP) that have established connection.

We will look at all the columns one by one:

• Netid - It is simply a Socket type. TCP, UDP, SOCK_SEQPACKET, and ICMP are common types of sockets.
• State - The socket's state. Common states of sockets can be SYN-RECV, SYN-SENT, TIME-WAIT, or ESTB (established).
• recv-Q - Tells the number of packets that the queue receives.
• send-Q - Tells the number of packets sent from the queue.
• Local address: port - It shows the address of the local machine and the port.
• Peer address: port - It shows addresses and associated port numbers of the remote machines.

Syntax

ss [Options] [Filters]

You can use several options and filters with the ss command to get the data according to your requirements. You can get a list of all the available options using the following command:

ss -h

ss vs netstat command

The ss tool is included under iproute2 package and is the default in most Linux Distributions. To have netstat you need to install net-tools, which are already deprecated.

Compared to the netstat command, ss is quicker and simpler to use and provides information in a presentable format. ss fetches directly from the kernel.

The ss is not a complete replacement of netstat, some of the netstat command is replaced by ip command.

Installation

The ss command line utility comes pre-installed with most Linux distributions. The ss tool comes with the iproute2 package. However, your distribution doesn't have it installed if you get the "ss command not found" error message while running this command.

You can install it using one of the following commands:

Ubuntu

sudo apt install iproute2

RedHat

sudo yum install iproute2

Fedora

sudo dnf install iproute

How to Use ss Command

As with all Linux commands, the ss command operates by sending out the command executable and then using any assortment of the available options to follow it.

The ss command has fewer available options than the netstat command. However, this doesn't mean that it is less in functionalities. The ss command is somewhat more robust.

Note: Executing the ss command without any options or filters returns an exhaustive list of TCP sockets with established connections.

1. List network connections

You can list all listening and non-listening network connections using the -a or -all option.

ss -a

2. List listening sockets

To display only listening sockets, which are omitted by default, use -l or --listen option.

ss -l

3. List TCP connections

To display the TCP socket connection, use the -t or --tcp option.

 ss -t

To display the list of all the TCP connections, you can use the -a and -t options. This includes all states of the socket.

ss -at

To display the TCP connection for all the listening states, combine -l and -t options.

ss -alt

4. List all listening TCP connections

To display the TCP connection for all the listening states, combine -l and -t options.

ss -alt

5. List UDP connections

To display the UDP socket connection, use -u or --udp option.

ss -u

To display the list of all the UDP connections, use -a and -u options. This includes all states of the socket.

ss -au

6. List all listening UDP connections

You can combine -l and -u to display the UDP connection for all the listening states.

ss -lu

7. List Unix sockets

To display all the Unix sockets, you can use the ss command along with -f unix or -x.

ss -f unix

8. List raw sockets

To display all the Raw sockets, you can use -w or --raw option.

ss -w

9. List the connection of an IP address

We can use ss command to display the list connection of a specific destination or source IP address.

For example to list connection of destination IP address:

ss dst 157.240.227.60

For example to list connection of source IP address:

ss src 192.168.18.151

10. List IPv4 and IPv6 socket connections

If you want to display the list of IPv4 socket connections use -4 option and -6 to display the list of IPv6 socket connections.

To display IPv4 socket connection list:

ss -4

To display the IPv6 socket connection list:

ss -6

To list all the IPv4 TCP connections, you can use the following example.

ss -at4

11. Identify processes

You can find the processes of sockets using the -p option along with the ss command. To identify the process, you will need sudo permission.

sudo ss -t -p 

12. List connections with no hostname resolution

To resolve the numeric address/ports use -r (resolve) option. Whereas the -n option does not try to resolve service names.

Here in the example, you can see the difference between the two:

$ ss -tn
 State  Recv-Q Send-Q  Local Address:Port Peer Address:Port   Process
 ESTAB  0      0       74.208.235.196:22  48.192.234.17:60216
$ ss -tr
 State  Recv-Q Send-Q Local Address:Port         Peer Address:Port  Process
 ESTAB  0      64     li82-186.members.linode.com:ssh                          n47-172-231-17.sun4.vic.optusnet.com.au:60317
$

13. Filter by connection

The ss command allows advanced filtering of results and searching for specific ports or TCP states.

Filter using TCP states

To filter TCP connection with state listening, type:

ss -t state listening

You can also use the grep command to filter conventionally. I'm showing all the TCP connections in the state of listening here:

ss -at | grep LISTEN

To display established ssh port connections:

ss -tr state established '( dport = :22 or sport = :22 )'

Filter by port number

Filter for a specific destination port number or port name:

ss <options> dst :<port number or name>

For example, use a port name:

ss dst :https

ss Command Options

As stated earlier in the document, the ss command can take in some optional parameters to get specific information about the network. Following is the list of all the options and their corresponding description:

Options	Description
-h	Displays a list of all options.
-V	Displays the version information.
-n	Service names are not resolved.
-r	Host names are resolved
-a	Displays all sockets
-l	Displays all listening sockets
-o	Displays timer information
-e	show detailed socket information
-m	show socket memory usage
-p	show process using socket
-i	show internal TCP information
–-tipcnfo	show internal tipc socket information
-s	show socket usage summary
-b	show bpf filter socket information
-E	continually display sockets as they are destroyed
-Z	display process SELinux security contexts
-z	display process and socket SELinux security contexts
-N	switch to the specified network namespace name
-4	display only IP version 4 sockets
-6	display only IP version 6 sockets
-0	display PACKET sockets
-t	display only TCP sockets
-M	display only MPTCP sockets
-S	display only SCTP sockets
-u	display only UDP sockets
-d	display only DCCP sockets
-w	display only RAW sockets
-x	display only Unix domain sockets
-f	FAMILY display sockets of type FAMILYFAMILY := {inet|inet6|link|unix|netlink|vsock|tipc|xdp|help}
-K	forcibly close sockets, display what was closed
-H	Suppress header line
-O	socket's data printed on a single line
-D	Dump raw information about TCP sockets to FILE
-F	read filter information from FILE

ss command State Filters

It provides a method for the construction of any set of matching states. Its syntax consists of the keywords state and excludes in that order, followed by the state's identifier.

Available identifiers established, syn-sent, syn-recv, fin-wait-1, fin-wait-2, time-wait, closed, close-wait, last-ack, listening, and closing are all common TCP statuses. The following table briefs all these states:

State Filter	Description
all	for all the states
connected	all the states except for listening and closed
synchronized	all the connected states except for syn-sent
bucket	states, which are maintained as minisockets, i.e. time-wait and syn-recv
big	opposite to bucket

Conclusion

The ss command utility is an easier and faster successor to the primitive netstat command. It provides advanced filtering options for socket and network statistics. Therefore, it is a must-know tool for network troubleshooting use cases.

You can follow the man page of the ss command for more details.