Showing a socket summary with ss -s is a fast way to judge whether a Linux host is dealing with normal connection levels, large numbers of short-lived sockets, or unusual cleanup activity before digging through a full socket listing. The command reduces a busy network stack to a few counters that are easier to read during triage.
The ss utility is part of the iproute2 suite and is the standard replacement for older tools such as netstat. Its summary mode reads socket statistics from kernel sources and highlights high-level protocol and state counters such as estab, timewait, and orphaned instead of printing every local and remote endpoint.
Because ss -s reports summary statistics rather than a full live socket list, some totals can stay higher than the currently open rows in the transport table after bursts of short-lived TCP activity. Use it as a first-pass baseline, then move to a filtered ss query when one protocol or state needs exact endpoints.
$ ss -s Total: 2 TCP: 95 (estab 0, closed 94, orphaned 0, timewait 1) Transport Total IP IPv6 RAW 0 0 0 UDP 0 0 0 TCP 1 1 0 INET 1 1 0 FRAG 0 0 0
The summary comes from kernel statistics rather than a full socket listing, so the TCP: totals can stay high after short-lived connections close.