ss and ethtool: Inspect Sockets and NIC Stats

Two tools matter more than almost anything else when a Linux server's networking misbehaves: ss for sockets and connections, and ethtool for the network interface card itself. These are the tools you reach for when an application is slow, connections pile up, or a NIC silently drops packets. Together they build a complete picture of what is happening between your daemons and the wire.

Inspecting Connections with ss

The ss command replaced netstat for socket statistics. It shows open sockets, their states, and the processes that own them. It is significantly faster than netstat on loaded servers because it reads directly from kernel data structures.

ss -t -a
ss -t -l -n
ss -s
ss -ul

The -t flag filters to TCP, -u to UDP. The -a flag shows all sockets including listening ones, -l only listening ones, and -n disables name resolution for speed. The -s summary prints a count of established, time-wait, and listening sockets, which gives an instant health snapshot.

Finding Who Owns Connections

The most valuable ss feature is associating a socket with its owning process. This tells you exactly which daemon is using a port, or which connections are piling up in TIME_WAIT.

ss -tpn
ss -tn state established '( dport = :443 or sport = :443 )'
ss -tn state time-wait
ss -tn -o state established

The -p flag shows the process. The -o flag adds timers, including the time remaining before a socket times out or retransmits. Filtering by state lets you zero in on connections stuck in TIME_WAIT, FIN_WAIT, or SYN_SENT, each of which indicates a different kind of problem.

Understanding Connection States

A healthy web server shows mostly ESTABLISHED and LISTEN sockets. A flood of TIME_WAIT sockets after a traffic spike is normal. Persistent SYN_SENT states mean outgoing connections are failing at the network layer. Close_Wait sockets mean the local application stopped reading data while the remote side closed the connection, usually a bug in application code.

ss -tan | awk '{print $1}' | sort | uniq -c | sort -rn

This one-liner counts sockets by state and sorts them by frequency. Running it periodically reveals trends: a growing TIME_WAIT count during peaks, or an unexpected buildup of SYN_RECV indicating a SYN flood or misconfigured firewall.

NIC Statistics with ethtool

While ss looks at sockets, ethtool inspects the physical and logical NIC. It reports link speed, duplex mode, driver information, and hardware error counters. On a VPS the virtual NIC presents itself to ethtool just like physical hardware, and the same counters are available.

ethtool eth0
ethtool -S eth0
ethtool -i eth0
ethtool -k eth0

The base command shows link settings including speed and duplex. The -S flag dumps per-queue statistics: RX packets, TX packets, dropped frames, and errors. The -i flag shows the driver and firmware version. The -k flag lists offload features like TCP segmentation offload and checksum offload that the NIC handles in hardware.

Reading the Diagnostic Counters

The -S output contains dozens of counters. A few matter most for debugging. rx_dropped and tx_dropped measure frames the driver discarded. rx_errors and tx_errors count corrupted frames. A rising error counter usually points to a hardware issue, a duplex mismatch, or a faulty cable, none of which are solvable purely in software.

ethtool -S eth0 | grep -E 'drop|error|miss'

This extracts only the drop and error counters. Run it twice a few minutes apart. If the numbers climb while you are idle, you have a genuine NIC-level problem rather than normal burst traffic. On a virtualized NIC, consistently increasing rx_missed can indicate the hypervisor is dropping frames faster than the guest can consume them.

Offload Features and Their Trade-offs

ethtool -k shows offload features, some of which can be toggled. TCP segmentation offload lets the NIC split large buffers into packets, reducing CPU burden. Generic receive offload reduces interrupts. But offloads sometimes interact badly with capture and filtering tools, or with certain virtual NIC drivers.

ethtool -K eth0 rx-checksumming off
ethtool -K eth0 gro off

You rarely need to disable offloads on a modern VPS. But if tcpdump shows malformed packets or checksum tests fail intermittently, disabling a specific offload is a legitimate diagnostic step. Remember that offload changes are not persistent across reboots unless you add them to startup scripts or systemd units.

Combining ss and ethtool in a Diagnosis

The two tools complement each other. If ss shows successful connections but the application is slow, the bottleneck may be at the NIC level, so check ethtool counters for drops. If ethtool shows a healthy interface but sockets are stuck, the problem is in the application layer or the routing configuration.

Consider a scenario: your web traffic slows to a crawl. ss -s shows thousands of TIME_WAIT sockets, and ethtool -S shows rising rx_dropped. The TIME_WAIT pileup is a symptom of high connection churn, and the rx_dropped counters suggest the receive path is overwhelmed. Together these point to a need for connection pooling or a larger ring buffer, not a single broken component.

You can observe these counters in action on any Netbay VPS, where full console and NIC access let you run ss and ethtool freely at netbayhosts.in.