Gathering socket data with ss

The daemons started by init and xinetd may not be the only services running on a system. Daemons can be started by commands in an init local file (/etc/rc.d/rc.local), a crontab entry, or even by a user with privileges.

The ss command returns socket statistics, including services using sockets, and current socket status.

Getting ready

The ss utility is included in the iproute2 package that is already installed on most modern distributions.

How to do it...

The ss command displays more information than the netstat command. These recipes will introduce a few of its features.

Displaying the status of tcp sockets

A tcp socket connection is opened for every HTTP access, every SSH session, and so on. The -t option reports the status of TCP connections:

    $ ss -t
    ESTAB      0      0   192.168.1.44:740          192.168.1.2:nfs  
    ESTAB      0      0   192.168.1.44:35484        192.168.1.4:ssh

    CLOSE-WAIT 0      0   192.168.1.44:47135         23.217.139.9:http  ...