Examining the Column named Closed in ss Command

Total: 246
TCP: 129 (estab 87, closed 28, orphaned 4, timewait 28)
Transport Total IP IPv6
RAW 1 0 1
UDP 6 4 2
TCP 101 94 7
INET 108 98 10
FRAG 0 0 0

The ss stands for socket statistics.

How does ss collect/calculate socket statistics?

A screenshot from ss’ source code
s.tcp_total - (s.tcp4_hashed + s.tcp6_hashed - s.tcp_tws)
ss is parsing the output of the /proc/net/sockstat and proc/net/sockstat6
root@adil:~# cat /proc/net/sockstat && echo "---" && cat /proc/net/sockstat6 && echo "---" && ss -ssockets: used 400
TCP: inuse 143 orphan 1 tw 38 alloc 247 mem 86
UDP: inuse 4 mem 3
UDPLITE: inuse 0
RAW: inuse 0
FRAG: inuse 0 memory 0
---
TCP6: inuse 4
UDP6: inuse 2
UDPLITE6: inuse 0
RAW6: inuse 1
FRAG6: inuse 0 memory 0
---
Total: 400
TCP: 285 (estab 136, closed 138, orphaned 1, timewait 38)
Transport Total IP IPv6
RAW 1 0 1
UDP 6 4 2
TCP 147 143 4
INET 154 147 7
FRAG 0 0 0
s.tcp_total   = 247
s.tcp4_hashed = 143
s.tcp6_hashed = 4
s.tcp_tws = 38
s.tcp_total - (s.tcp4_hashed + s.tcp6_hashed - s.tcp_tws)
247 - (143 + 4 - 38)
Result (the number of closed connections): 138

What about the other 100 TCP sockets?

We know that the closed connections are calculated based on the “alloc” column. So now we need to examine the “alloc” column in the output of /proc/net/sockstat now.

What is the alloc column in the sockstat output?

In the socket statistics, there are 2 types of TCP sockets: allocated and in use.

In TCP socket creation, the required fields are set in the sock_init_data function in the source code
<?php
$socket = [];
for($i = 0; $i < 100; $i++){
$socket[$i] = socket_create(AF_INET, SOCK_STREAM, 0);
}
sleep (30);
root@adil:~# ss -s
Total: 145
TCP: 4 (estab 2, closed 0, orphaned 0, timewait 0)
Transport Total IP IPv6
RAW 1 0 1
UDP 1 1 0
TCP 4 3 1
INET 6 4 2
FRAG 0 0 0
root@adil:~# ss -s
Total: 245
TCP: 104 (estab 2, closed 100, orphaned 0, timewait 0)
Transport Total IP IPv6
RAW 1 0 1
UDP 1 1 0
TCP 4 3 1
INET 6 4 2
FRAG 0 0 0

--

--

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store