linux : netstat listening queue length

Question

Is there a way to view queue length on listening socket under Linux, the same way as netstat -L outputs for FreeBSD? I.e. you can see X/Y/Z in netstat -L output, but netstat under Linux doesn't support -L flag.

Alexander · Answer 1 · 2018-09-13T07:39:35.593

Let's look into source code, as it's the best documentation in the world of open source.

net/ipv4/tcp_diag.c:

if (sk->sk_state == TCP_LISTEN) {
    r->idiag_rqueue = sk->sk_ack_backlog;
    r->idiag_wqueue = sk->sk_max_ack_backlog;
} else {
    r->idiag_rqueue = max_t(int, tp->rcv_nxt - tp->copied_seq, 0);
    r->idiag_wqueue = tp->write_seq - tp->snd_una;
}

The same thing we can see in unix domain sockets, net/unix/diag.c:

if (sk->sk_state == TCP_LISTEN) {
    rql.udiag_rqueue = sk->sk_receive_queue.qlen;
    rql.udiag_wqueue = sk->sk_max_ack_backlog;
} else {
    rql.udiag_rqueue = (u32) unix_inq_len(sk);
    rql.udiag_wqueue = (u32) unix_outq_len(sk);
}

So.

If socket is established, Recv-Q and Send-Q means bytes as it's described in documentation.
If socket is listening, Recv-Q means current queue size, and Send-Q means configured backlog.

Going deeper into mans gives us folowing in sock_diag(7):

      UDIAG_SHOW_RQLEN
             The attribute reported in answer to this request is
             UNIX_DIAG_RQLEN.  The payload associated with this
             attribute is represented in the following structure:

                 struct unix_diag_rqlen {
                     __u32 udiag_rqueue;
                     __u32 udiag_wqueue;
                 };

             The fields of this structure are as follows:

             udiag_rqueue
                    For listening sockets: the number of pending
                    connections.  The length of the array associated
                    with the UNIX_DIAG_ICONS response attribute is
                    equal to this value.

                    For established sockets: the amount of data in
                    incoming queue.

             udiag_wqueue
                    For listening sockets: the backlog length which
                    equals to the value passed as the second argu‐
                    ment to listen(2).

                    For established sockets: the amount of memory
                    available for sending.

In other words, ss -ln is the only command you need

Thanks for the in-depth information, Alexander! Just a quick addition: `udiag_wqueue` might be different than the value you passed to `listen(2)` if `/proc/sys/net/core/somaxconn` is smaller than the backlog value set in the syscall. That's because Linux caps the value: https://elixir.bootlin.com/linux/v4.15/source/net/socket.c#L1479 — Ciro Costa, Oct 21 '18 at 00:35

score 12 · Answer 2 · edited Sep 27 '12 at 22:45

12

ss -l shows the correct Recv-Q Send-Q.

edited Sep 27 '12 at 22:45

HopelessN00b

53,795
33
135
209

answered Sep 27 '12 at 22:35

Artem G

351
1
2
6

Pavel Timofeev · Answer 3 · 2017-09-19T12:32:07.183

2

There is no simple way to see that on Linux as far as I know. Recv-Q and Send-Q are not listen queue. They are the count of bytes not copied by the user program connected to the socket and not acknowledged by the remote host (see man netstat). So they are about established connections. Listen (accept) queue is a place where kernel keeps new incoming connections until your application calls accept().

edited Sep 19 '17 at 12:32

answered Sep 19 '17 at 06:08

Pavel Timofeev

29
3

Sorry, I wasn't completely correct. netstat and ss on new Linux distributions show different things as Recv-Q and Send-Q value depending on if it's established connection or listening socket. This is from CentOS 7.4: Recv-Q Established: The count of bytes not copied by the user program connected to this socket. Listening: Since Kernel 2.6.18 this column contains the current syn backlog. Send-Q Established: The count of bytes not acknowledged by the remote host. Listening: Since Kernel 2.6.18 this column contains the maximum size of the syn backlog. – Pavel Timofeev Sep 21 '17 at 12:26
However on my CentOS 7.4 only ss shows correct Send-Q (i. e. backlog, listen/accept queue) value for listening socket, but netstat doesn't – Pavel Timofeev Sep 21 '17 at 12:32

score 1 · Answer 4 · answered Sep 26 '12 at 04:29

1

awk can help:

netstat -ntp | awk '{ if ($6 == "ESTABLISHED" && $7 == "-") arrQueue[$4] += 1; } END { for (service in arrQueue) print service" "arrQueue[service] }'

Source: http://mysyslog.ru/posts/633

answered Sep 26 '12 at 04:29

quanta

51,413
19
159
217

Thanks for the answer. Actually ss -l shows the correct Recv-Q Send-Q, so its faster to do it not with awk. – Artem G Sep 27 '12 at 22:34

score 0 · Answer 5 · answered Mar 16 '19 at 07:54

0

In addition to ss(classical iproute), there's ss2(pyroute) by now to do that.

answered Mar 16 '19 at 07:54

cherusk

21
5

linux : netstat listening queue length

5 Answers5