3 ms·

strace is quite useful too as a starting point. for example you can easily see that `ss` gets its information through netlink (ditto about netstat).