On Linux 2.6.32, if you read (for example, cat) /proc/net/tcp, on a very loaded system (for example, a web server), you will find that reading 100K entries takes over 30 seconds. That's a long time.

What's going on behind the scenes? Is there locking going on?

Many people mention the speed of the 'ss' command. What is the 'ss' command doing that 'cat /proc/net/tcp' or 'netstat' isn't doing that makes it so much faster?

1 Answer 1


ss uses the AF_NETLINK socket layer to talk to the kernel. This is a lower level protocol but allows for data to be transferred very quickly and in large chunks. A quick strace on CentOS 7 shows it sets the transfer window to be 1Mb.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .