TCP

Most important commands to remember

• ss -ltn — find listening TCP sockets.
• ss -tin state established — inspect established TCP connections and transport details.

Commands and flags

Option or argument	Meaning
-l / -t / -n	Select listeners, select TCP, and keep addresses and ports numeric.
-i	Include internal TCP information where available.
state established	Filter for connections whose TCP handshake has completed.

ss reads kernel socket information; it does not send a request.

The concepts that matter

1. TCP establishes a conversation between endpoints

TCP, the Transmission Control Protocol, connects two endpoints identified by their IP addresses and ports. A server typically listens; a client initiates a connection. The usual handshake exchanges SYN, SYN-ACK, and ACK to synchronize the connection’s starting state.

An established TCP connection is transport state. It does not prove that login succeeded or the application can process a request. TLS and application protocols add their own exchanges afterward.

2. Applications receive an ordered byte stream

TCP delivers bytes in order and hides ordinary packet reordering from the application. It does not preserve the boundaries of individual writes: two writes may arrive in one read, or one write in several reads.

The application protocol must define message boundaries, for example using lengths or delimiters. TCP also provides no encryption by itself. Reliable transport and confidential transport solve different problems.

3. Acknowledgments and retransmissions repair loss

Sequence numbers identify positions in the byte stream. Acknowledgments report receipt, allowing the sender to retransmit data believed lost. This recovery takes time, so an apparently slow request can reflect loss rather than slow application computation.

A TCP acknowledgment means the remote transport received bytes, not that a database committed them or a user action completed. Applications need their own success responses, and connection failure can leave the result uncertain.

4. Two controls limit how much can be in flight

Flow control protects the receiver: its advertised receive window indicates how much more data it can accept. Congestion control protects the network by adapting the sender’s outstanding traffic to observed conditions.

These limits differ. A receiver that stops reading and a congested network can both slow a connection, but require different investigations. Closing also has state: FIN supports an orderly end of sending, while RST aborts a connection.

One small example

Optional: run the two commands on Linux. If connected over SSH, that session may supply an established connection to inspect.

ss -ltn
ss -tin state established

The first command shows listeners, not conversations. Read the local address and port. The second shows established endpoints and any available TCP details: rtt is round-trip timing in milliseconds, while cwnd is a congestion-window value expressed in segments.

For established connections, Recv-Q represents queued data not yet read by the application and Send-Q data not yet acknowledged. Listener queues use different meanings. Values change over time; one snapshot does not establish a persistent bottleneck.

An empty established list is normal when there are no matching connections. No connection is created or closed, so nothing needs cleanup.

Keep this idea: TCP supplies an ordered byte stream; the application still defines messages and confirms business success.