Linux: Proc/Net/Sockstat Tcp Mem More and More Larger

In /proc/sockstat which TCP states count as 'inuse' and which count as 'alloc'?

Which of the above count as 'inuse' and which count as 'alloc' ?

You already got close to the answer by locating sockstat_seq_show - we can see that 'inuse' is the value of sock_prot_inuse_get(net, &tcp_prot), and 'alloc' is the value of proto_sockets_allocated_sum_positive(&tcp_prot). Now it's not always easy to follow the call chain further down, but I, if not mistaken, arrive at the following conclusions.

  1. 'alloc' - This at bottom is the sum of percpu_counter tcp_sockets_allocated, which gets incremented in tcp_init_sock(); there the socket state is initialized to TCP_CLOSE. Whatever state changes the socket undergoes during its existence, 'alloc' doesn't depend on - all TCP states count as 'alloc'.
  2. 'inuse' - This is the sum of the (per CPU) counters net->core.inuse or prot_inuse (for the TCP in this case), which essentially get incremented and decremented by calls of sock_prot_inuse_add(…, 1) resp. (…, -1) in inet_hash() resp. inet_unhash(). The condition in inet_hash() is if (sk->sk_state != TCP_CLOSE), so all TCP states except TCP_CLOSE count as 'inuse'.

I think this means in theory any socket in a state >= TCP_CLOSE is not counted as 'inuse'

In my view that can't be so, since also TCP_LISTEN > TCP_CLOSE, and a socket in TCP_LISTEN state surely is counted as 'inuse', as can be seen with e. g.

(cd /proc/net; cat sockstat; nc -l 8888& sleep 1; cat sockstat; kill $!; cat sockstat)|grep TCP

Is there a way to find out the total memory used by UDP sockets on a system

Could it be that you have a low traffic?

This is on my machine, receiving 400 UDP packets/sec on 3 ports (there is a 4th UDP stream but I don't use that).

# cat /proc/net/sockstat
sockets: used 32
TCP: inuse 6 orphan 0 tw 0 alloc 6 mem 1
UDP: inuse 4 mem 3

The same machine, serving those UDP streams to loads of clients on HTTP:

#cat /proc/net/sockstat
sockets: used 7232
TCP: inuse 7206 orphan 0 tw 0 alloc 7206 mem 405397
UDP: inuse 4 mem 30

The HTTP server is single threaded so I had to set the receive buffer for the UDP sockets quite high to not lose any packets. I've run the test for a while but I've never seen UDP mem go above 50.

In ss -s, what is the kernel counter actually counting?

what is kernel 1071 actually counting?

sock_inode_cache represents Linux kernel Slab statistics. It shows how many socket inodes (active objects) are there.

struct socket_alloc corresponds to the sock_inode_cache slab cache and contains the struct socket and struct inode, so it is connected to VFS.



Related Topics



Leave a reply



Submit