How do you filter ss output, and how do you check the health of a single TCP connection?
Show the answer
Say this first
ss has its own filter language: states (state established, state time-wait), addresses (dst,
src) and ports (dport = :443), combined with and, or and parentheses. For one connection,
ss -tni prints the kernel's TCP internals: RTT, RTO, congestion window, MSS, retransmissions and
the congestion algorithm, which tells you whether a slow transfer is loss, latency or the application.
Go deeper
Filters
ss -tn state established '( dport = :443 or sport = :443 )'
ss -tn dst 10.0.20.0/24
ss -tan state time-wait | wc -l
ss -to state established dport = :5432 # -o adds timers (keepalive, retransmit)
ss -s # totals per state and protocolQuote the expression so the shell does not eat the parentheses. Ports are written with a leading colon,
:443, as in the man page examples.
TCP internals for one flow (trimmed)
$ ss -tni dst 198.51.100.80
State Recv-Q Send-Q Local Address:Port Peer Address:Port
ESTAB 0 0 10.0.10.21:51544 198.51.100.80:443
cubic wscale:7,7 rto:204 rtt:3.1/1.2 mss:1448 pmtu:1500 cwnd:10 retrans:0/2 send 37.4Mbpsrtt:3.1/1.2: smoothed RTT and its variation in ms.rto:204: retransmission timeout. Linux keeps a 200 ms minimum, so short RTT paths sit just above it.cwnd:10segments,mss:1448(1500 minus IP, TCP and the 12-byte timestamp option).retrans:0/2: retransmissions outstanding now / in total. A growing total means loss on the path.send 37.4Mbpsis cwnd times MSS divided by RTT, the rate the window currently allows.
They will ask next
There are thousands of TIME-WAIT sockets. Is that a problem?
Usually not. TIME-WAIT sits on the side that closed first and lasts 60 seconds on Linux. It hurts only when one client opens so many short connections to the same destination and port that it runs out of ephemeral ports (
net.ipv4.ip_local_port_range, 32768 to 60999 by default). Then use connection pooling, ornet.ipv4.tcp_tw_reusefor outgoing connections.And thousands of CLOSE-WAIT?
That is an application bug. The peer closed, the kernel acknowledged, and the local program never called close on the socket. The network is fine.
Traps
- Forgetting the quotes around a filter with parentheses, so the shell eats them and ss reports a syntax error.
- Blaming the network for CLOSE-WAIT build-up.