Examining the Column named Closed in ss Command

Total: 246
TCP: 129 (estab 87, closed 28, orphaned 4, timewait 28)
Transport Total IP IPv6
RAW 1 0 1
UDP 6 4 2
TCP 101 94 7
INET 108 98 10
FRAG 0 0 0

The ss stands for socket statistics.

How does ss collect/calculate socket statistics?

A screenshot from ss’ source code
s.tcp_total - (s.tcp4_hashed + s.tcp6_hashed - s.tcp_tws)
ss is parsing the output of the /proc/net/sockstat and proc/net/sockstat6
root@adil:~# cat /proc/net/sockstat && echo "---" && cat /proc/net/sockstat6 && echo "---" && ss -ssockets: used 400
TCP: inuse 143 orphan 1 tw 38 alloc 247 mem 86
UDP: inuse 4 mem 3
UDPLITE: inuse 0
RAW: inuse 0
FRAG: inuse 0 memory 0
---
TCP6: inuse 4
UDP6: inuse 2
UDPLITE6: inuse 0
RAW6: inuse 1
FRAG6: inuse 0 memory 0
---
Total: 400
TCP: 285 (estab 136, closed 138, orphaned 1, timewait 38)
Transport Total IP IPv6
RAW 1 0 1
UDP 6 4 2
TCP 147 143 4
INET 154 147 7
FRAG 0 0 0
s.tcp_total   = 247
s.tcp4_hashed = 143
s.tcp6_hashed = 4
s.tcp_tws = 38
s.tcp_total - (s.tcp4_hashed + s.tcp6_hashed - s.tcp_tws)
247 - (143 + 4 - 38)
Result (the number of closed connections): 138

What about the other 100 TCP sockets?

What is the alloc column in the sockstat output?

In TCP socket creation, the required fields are set in the sock_init_data function in the source code
<?php
$socket = [];
for($i = 0; $i < 100; $i++){
$socket[$i] = socket_create(AF_INET, SOCK_STREAM, 0);
}
sleep (30);
root@adil:~# ss -s
Total: 145
TCP: 4 (estab 2, closed 0, orphaned 0, timewait 0)
Transport Total IP IPv6
RAW 1 0 1
UDP 1 1 0
TCP 4 3 1
INET 6 4 2
FRAG 0 0 0
root@adil:~# ss -s
Total: 245
TCP: 104 (estab 2, closed 100, orphaned 0, timewait 0)
Transport Total IP IPv6
RAW 1 0 1
UDP 1 1 0
TCP 4 3 1
INET 6 4 2
FRAG 0 0 0

--

--

--

Love podcasts or audiobooks? Learn on the go with our new app.

Recommended from Medium

[FSearch] Beautiful Flutter search bar

Repeat Code with LeetCode — Fruits Into Baskets

Entity Framework Tips(Part2)

Why is OCI better? Oracle Cloud Infrastructure’s Compute vs Other Cloud Providers’ Compute

K.O.P Event 2! <Blog Event>

You don’t need more developers

Tts Reader For Mac

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store
adil

adil

More from Medium

Linux kernel 2.6.* gcc error: “elf_x86_64: no file or directory” & “unrecognized command -m”

duf — A beautiful Linux alternative for df & du

Everything is a File

Unix Heredoc Cheatsheet