I am observing significant network connetions that come from Tixati (same IPs in peer list and iftop), but are not visible in netstat or ss.
Do I use the wrong options for those? Or is Tixati using network APIs that bypass the socket layer?

Only TCP connections can be displayed by netstat/ss. While you can show UDP ports that are listening, it won't show a full list of any UDP connections like Tixati's peer list does. By default Tixati prefers UDP over TCP.

Here are some examples for ss.

Show TCP connections with process id/name:
$ ss -tpn

Explanation: -t is for TCP. -p is for process id/name. and -n is to remove any port name. I use it because I prefer seeing a port number instead of port name such as http,ssh,etc..

Show TCP ports any programs/services are listening on:
$ ss -ltpn

Explanation: -l is for listening ports. Including -t with it limits it to TCP.

Show UDP ports any programs/services are listening on:
$ ss -lupn

Explanation: Same as above except we are limiting it to UDP with -u

Show both TCP and UDP listening ports:
$ ss -ltpnu

Thank you for the quick reply! Your first sentence says it all. (Those options I played with already did not achieve, now I know why.) strace might do, but that is a cannon against birds ...