How to show socket summary with ss

Showing a socket summary with ss -s is a fast way to judge whether a Linux host is dealing with normal connection levels, large numbers of short-lived sockets, or unusual cleanup activity before digging through a full socket listing. The command reduces a busy network stack to a few counters that are easier to read during triage.

The ss utility is part of the iproute2 suite and is the standard replacement for older tools such as netstat. Its summary mode reads socket statistics from kernel sources and highlights high-level protocol and state counters such as estab, timewait, and orphaned instead of printing every local and remote endpoint.

Because ss -s reports summary statistics rather than a full live socket list, some totals can stay higher than the currently open rows in the transport table after bursts of short-lived TCP activity. Use it as a first-pass baseline, then move to a filtered ss query when one protocol or state needs exact endpoints.

1. Run the socket summary view.

   $ ss -s
   Total: 2
   TCP:   95 (estab 0, closed 94, orphaned 0, timewait 1)
   
   Transport Total     IP        IPv6
   RAW      0         0         0
   UDP      0         0         0
   TCP      1         1         0
   INET     1         1         0
   FRAG     0         0         0

2. Check the TCP: line before the transport table to see whether the host is accumulating estab, timewait, or orphaned sockets.

   The summary comes from kernel statistics rather than a full socket listing, so the TCP: totals can stay high after short-lived connections close.

3. Move to a filtered socket listing if one protocol or state looks unusual.