linux · medium

Inspect Sockets — ss, netstat, Connection States & Queues

Reading sockets with ss: is the service listening and on a reachable address; on live connections, Recv-Q (app behind) vs Send-Q (peer behind); a state census separating TIME_WAIT churn from a CLOSE_WAIT fd leak; and the listening-socket backlog overflow.

The code

ss -ltnp     # listening tcp sockets + owning process
ss -tnp      # established connections + queues
#  Recv-Q = bytes waiting for the APP to read()
#  Send-Q = bytes sent, not yet ACKed by the peer

# Census of connection states
ss -tan | awk '{print $1}' | sort | uniq -c | sort -rn

# Listening socket: Recv-Q = accept-queue depth, Send-Q = backlog max
netstat -s | grep -i 'overflow\|listen'

What this lesson walks through

1. 01Is it listening, and where?
2. 02Recv-Q vs Send-Q — who's behind?
3. 03Read the state census
4. 04Is the listen backlog overflowing?

0.0.0.0 = reachable from the network; 127.0.0.1 = localhost-only — the classic 'works in test, dead in prod' bug.