Sockets


A socket is a communication endpoint for two programs talking to each other. If the socket is connected over a network, the programs can run on different devices, such as a web browser running on a user's laptop and a web server running in a company's data center.

There are three main types of sockets:

Socket type Description
Unix Sockets Which connect processes running on the same device.
UPD (User Datagram Protocol) Sockets Which connect applications using a protocol which is fast but not resilient.
TCP (Transmission Control Protocol) Sockets Which are more reliable than UDP sockets and, for example, confirm the receipt of data.
Unix sockets can only connect applications running on the same device. TCP and UDP sockets however can connect over a network. TCP allows for a stream of data that always arrives in the exact order it was sent. UDP is more fire and forget; the packet is sent but its delivery at the other end is not guaranteed.

UDP does however lack the overhead of TCP, making it perfect for low latency applications such as online video games.

To get more information about the current system's sockets, use the Socket Statistics:


Socket Statistics

ss is an utility to investigate sockets.

Syntax

ss [options] [ FILTER ]

ss is used to dump socket statistics. It allows showing information similar to netstat. It can display more TCP and state information than other tools.


Important options

Options Description
-t Show only TCP connections.
-u Show only UDP connections.
-l or --listening Show listening sockets.
-p or --processes Show process using socket.
-s or --summary Print summary statistics. This option does not parse socket lists obtaining summary from various sources.
-n or --numeric Do not try to resolve service names. Show exact bandwidth values, instead of human-readable.

Filters

Syntax

FILTER := [ state SOCKET_OPTIONS ] [ exclude SOCKET_OPTIONS ] [ EXPRESSION ]

With state the sockets can be: ESTABLISHED, LISTENING, CLOSED, CONNECTED, TIME-WAIT, etc.

With exclude some sockets that met the state criteria are excluded.

EXPRESSION can be constructed with:

  • Logical operators: and, or and not
  • Origin and destination: {src|dst} [ IP[/prefix] ][ :port ]
  • Socket origin and destination: {dport|sport} {eq|neq|gt|ge|lt|le} [IP]:port

Example:

ss state established '(sport = :http or sport = :https)' src 192.188.1.0/24

With this, socket statistics shows sockets that:

  • Have an established state
  • Their origin port (sport) is http or https
  • And their source is the 192.188.1.0/24 address