UDP

Most important commands to remember

• ss -uan — inspect all UDP sockets numerically.
• ss -uapn — include owning-process information when permitted.

Commands and flags

Option	Meaning
-u	Select UDP sockets.
-a	Include both connected and unconnected sockets.
-n	Keep addresses and ports numeric.
-p	Show available process names, PIDs, and file descriptors.

These are read-only snapshots, not UDP delivery tests.

The concepts that matter

1. UDP sends separate datagrams

UDP, the User Datagram Protocol, sends individual messages called datagrams between IP addresses and ports. Unlike a TCP byte stream, it preserves message boundaries: the receiving application receives a datagram rather than an arbitrary slice of a continuous stream.

A receive buffer that is too small can truncate a datagram. UDP does not turn a large application message into a convenient sequence of independently reliable messages for you.

2. Sending does not establish delivery

UDP has no TCP-style connection handshake, acknowledgment stream, retransmission, or ordering guarantee. Datagrams can be lost, duplicated, or reordered. A successful send usually means the local stack accepted the data, not that the remote application processed it.

A protocol above UDP decides what to do about this: ignore stale updates, retry a request, attach sequence numbers, or build reliable streams. QUIC is an example of a richer transport built over UDP.

3. Connectionless does not mean stateless everywhere

An application can connect a UDP socket to a chosen peer. On Linux this sets a default destination and restricts received traffic to that peer. It does not perform a transport handshake with the remote application.

Firewalls and NAT devices can also track UDP flows and expire their state after inactivity. The absence of a UDP connection setup does not imply that every device treats every datagram independently.

4. Less built-in machinery means more application responsibility

UDP is useful when the application wants message-oriented exchange or needs to choose its own recovery strategy. It is not automatically faster under every workload, and it supplies no encryption by itself.

Applications still need congestion-aware behavior. Large datagrams can exceed a path’s packet-size limits and encounter fragmentation or rejection. A missing reply can mean filtering, loss, no listener, or simply a protocol that does not answer that message.

One small example

Optional: run these commands in a Linux terminal. No administrator access or test server is required.

ss -uan
ss -uapn

Read Local Address:Port and Peer Address:Port. A wildcard peer means the socket has no single configured peer. UNCONN is normal for such UDP sockets; it is not evidence of a broken TCP-style handshake. A connected UDP socket may display ESTAB without any handshake having occurred.

The second view adds ownership when your account is allowed to see it. An empty list means no matching sockets were present in this namespace at that instant. Queue values describe local buffering, not application acknowledgments or successful remote delivery.

No datagram is sent, no service is started, and there is nothing to clean up.

Keep this idea: UDP preserves individual messages; the protocol above it decides how to handle loss, ordering, and success.