LWM-Linux/12 - Network Configuration and Troubleshooting/Network Troubleshooting (ss).md

network troubleshooting using the ss (Socket Statistics)

1. Introduction to ss:

ss is a powerful utility for investigating sockets. It replaces the older netstat command and provides more detailed information about network connections.

2. Basic usage:

To display all connections:

ss

3. Common options:

• -t: Show TCP sockets
• -u: Show UDP sockets
• -l: Show only listening sockets
• -a: Show both listening and non-listening sockets
• -n: Don't resolve service names
• -p: Show process using the socket

4. Displaying TCP connections:

ss -t

5. Showing listening sockets:

ss -l

6. Combining options:

To show listening TCP sockets with process information:

ss -tlp

7. Filtering connections:

• By state:

  ss state established
  

• By port:

  ss sport = :80
  

• By IP address:

  ss dst 192.168.1.1
  

8. Advanced filtering:

Use expressions for complex filters:

ss -t '( dport = :ssh or sport = :ssh )'

9. Displaying socket statistics:

ss -s

10. Checking for specific issues:

- High number of TIME_WAIT connections:
  ```
  ss -t state time-wait | wc -l
  ```
- Connections in SYN-SENT state (potential connectivity issues):
  ```
  ss -t state syn-sent
  ```

11. Investigating socket buffers:

ss -tm

12. Displaying timer information:

ss -to

13. Checking for UNIX domain sockets:

ss -x

14. Combining with other tools:

• Use with grep for specific searches:

  ss -tuln | grep :80
  

• Pipe to less for easier navigation:

  ss -tuna | less
  

15. Troubleshooting steps:

• a. Check for listening services: ss -tlnp
• b. Verify established connections: ss -tnp state established
• c. Look for connection attempts: ss -tnp state syn-sent
• d. Investigate connection closures: ss -tnp state time-wait
• e. Check for any unusual states or high connection counts

16. Performance considerations:

- Use `ss -i` to display TCP internal information
- Monitor retransmission rates and window sizes

17. Security checks:

- Look for unexpected listening ports
- Check for connections from unknown IP addresses

18. Debugging application issues:

- Use `-p` option to correlate sockets with processes
- Investigate socket states for hung connections

19. Network tuning:

- Use socket statistics to identify bottlenecks
- Adjust system parameters based on observed behavior

20. Scripting with ss:

- Use in shell scripts for automated monitoring
- Combine with `awk` or `sed` for custom output formatting

Remember that some ss commands may require root privileges to access all information. Always use caution when interpreting network data, especially in production environments.