Sockets & File Descriptors
Most important commands to remember
ss -ltnp— inspect listening TCP sockets and their owning processes.ls -l /proc/PID/fd— inspect a process’s open file descriptors.
Commands and flags
These commands appear in the short example below.
| Command or option | Meaning |
|---|---|
ss -ltnp |
-l selects listening sockets, -t selects TCP, -n keeps addresses and ports numeric, and -p includes process information when permitted. |
ls -l "/proc/$$/fd" |
List the current shell’s descriptors. -l includes the targets of the numbered links. |
$$ is Bash syntax: it contains the current shell’s PID. /proc is Linux’s live view of kernel and process information.
The concepts that matter
1. A file descriptor is a process’s handle to a resource
A file descriptor (FD) is a small integer used by a process to access an open resource. That resource can be a regular file, terminal, pipe, or socket.
Descriptor numbers are local to each process. FD 3 in one process need not refer to the same resource as FD 3 in another. A descriptor is a handle, not a filename or a network address.
2. Input and output use descriptors too
The usual starting descriptors are 0: standard input, 1: standard output, and 2: standard error. In an interactive terminal, these commonly connect to the terminal device.
Shell redirection can connect them to files or pipes instead. Multiple descriptors can point to the same destination. Counting descriptors is therefore not automatically counting distinct files.
3. A socket is an endpoint; a port is part of its address
A socket is an operating-system communication endpoint accessed through a descriptor. TCP sockets use local and remote IP addresses and ports. Unix domain sockets support local communication without TCP or UDP ports.
A listening socket waits for connections. When a server accepts a TCP connection, it gets a separate connected socket; the listener remains available for new clients.
Several connections can share the server’s port because their local and remote address/port combinations distinguish them. A port number alone does not identify a particular process resource.
4. PID, FD, and port identify different things
The PID identifies the process. The FD identifies its local handle. The port is part of a network endpoint’s address.
ss can connect these views: its process information can include a program name, PID, and fd. In /proc/PID/fd, a link such as socket:[number] identifies a socket object; that number is a socket inode identifier, not its port.
This distinction helps investigate occupied ports and “too many open files” errors. A process can exhaust its descriptor limit through unclosed files or connections. A listening socket also proves only that something is listening, not that the application handles requests correctly.
One small example
Optional: run these commands in a Bash terminal on Linux:
ss -ltnp
ls -l "/proc/$$/fd"In ss, look for LISTEN, the local address and port, and any visible process information. 127.0.0.1 means IPv4 loopback; 0.0.0.0 means a wildcard bind to local IPv4 addresses. Binding alone does not establish reachability through firewalls. For listeners, Recv-Q counts queued connections awaiting acceptance and Send-Q shows the backlog limit, not bytes of application data.
No socket rows is a valid result if no TCP listeners exist. Ownership details for other users’ processes may be hidden by permissions.
The second command inspects your shell, which may have no network socket. Look for entries 0, 1, and 2 and read their link targets; additional descriptors can appear. These two commands demonstrate the system’s listener view and one process’s resource view, without assuming the shell owns a listener.
Nothing is started or changed, so no cleanup is needed.
Keep this idea: the port locates a network endpoint, the PID identifies its process, and the FD is that process’s handle to the resource.