Skip to content
Browse

/commands/ss/ss-tcp-info-rtt-retransmits

ss -ti: show TCP round-trip time, congestion window and retransmissions

The commands on this page have not been executed by our verification runner yet.updated
tool
ss / netstat
versions
iproute2 5.x, iproute2 6.x
os
linux

ss -ti prints the kernel's internal TCP state for each connection on a second line: smoothed round-trip time (rtt), retransmission timeout (rto), congestion window (cwnd), MSS, congestion control algorithm, bytes acked and received, and retransmission counters. It is the quickest way to see whether a slow connection suffers from latency, packet loss or a small window, without capturing packets.

bash
ss -ti                                   # all established TCP connections
ss -tni dst 192.0.2.10                   # one peer, numeric addresses
ss -tnio state established 'sport = :443'  # add timers, only my HTTPS server
ss -tnim 'dport = :5432'                 # add socket memory (skmem)

Fields you will read most

FieldMeaning
cubic / bbrCongestion control algorithm of the socket (cubic is the Linux default).
wscale:S,RWindow scale factors for send and receive.
rto:NRetransmission timeout in milliseconds.
rtt:A/BSmoothed round-trip time and its mean deviation, in milliseconds.
mss:NMaximum segment size used on the connection.
cwnd:NCongestion window, in segments.
ssthresh:NSlow start threshold; it appears after the window has been reduced.
bytes_acked / bytes_receivedPayload bytes the peer acknowledged and bytes received.
retrans:X/YSegments currently unacknowledged after retransmission / total retransmissions.
send Nbps, pacing_rateEstimated send rate and pacing rate.
lastsnd / lastrcv / lastackMilliseconds since the last send, receive and ACK.

How to read it

  • High rtt with no retransmissions is distance or a congested path: the connection is healthy but slow to round-trip. Compare with ping to the same host.
  • Growing retrans and a small cwnd mean packet loss; TCP keeps halving its window. Check interfaces for errors (ip -s link) and the path with mtr.
  • Large rto and a backoff value mean the kernel is backing off exponentially after unanswered retransmissions; the peer or the path stopped answering.
  • lastrcv large on an established connection points to an idle or stuck peer; with -o you also see the keepalive timer, if enabled.

Watch a single connection change over time with watch -n1 "ss -tni dst 192.0.2.10".

-o adds timer:(name,expire,retrans) (on, keepalive, timewait, persist), -m adds skmem:(...) buffer usage, -e adds the UID and inode, and -O prints everything on one line, which is easier to grep. Filters work as with any other ss command; see filter by port or address.

FAQ

What unit is the rtt value in?

Milliseconds. rtt:12.5/3.1 means a smoothed round-trip time of 12.5 ms with a mean deviation of 3.1 ms. rto, ato, lastsnd, lastrcv and lastack are milliseconds too.

Does ss -ti need root?

No. Any user can read TCP information for all sockets. Root is needed only for the process names that -p shows for sockets owned by other users.

Why do I not see the retrans field?

ss prints fields that have a value. A connection that has not retransmitted anything does not show retrans; it appears once the kernel has counted retransmitted segments.

Sources

Related pages

commands · ssss filter by port or IP: ss -tn 'dport = :443' and dst 10.0.0.5Filter ss output by port or address: sport, dport, src and dst predicates, state filters, comparison operators, quoting rules and the parse errors they avoid.cheat sheets · ssss cheat sheet: sockets, ports and connections on Linuxss cheat sheet for Linux: list listening ports with ss -tulpn, filter by state, port or address, count connections, and show processes and TCP internals.codes · ssTCP socket states in ss and netstat: ESTAB, TIME-WAIT, CLOSE-WAIT, SYN-SENT and moreTCP states shown by ss and netstat: LISTEN, ESTAB, TIME-WAIT, CLOSE-WAIT, SYN-SENT, FIN-WAIT. What each means and when large numbers point to a problem.compare · ssss vs netstat: differences and equivalent commandsss from iproute2 replaces netstat from net-tools: faster, with built-in filters and the same flags (ss -tulpn). Equivalent commands and output differences.