Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Given a linux TCP socket's inode (obtained via /proc/<pid>/fd), is there a faster way to look up the information that I can get from /proc/net/tcp about this socket?

I have written a troubleshooting tool which monitors processes and prints realtime information about IO operations (strace-type info collected into higher level abstractions and presented in a less raw way), but on a heavily loaded network server, I am finding that the time it takes to look up socket info (e.g. the foreign address/port) is prohibitive simply due to the very large size of /proc/net/tcp (about 2MB on the server I'm currently looking at).

I can manage this somewhat with caching, but this necessarily introduces latency and makes me wonder about the absurdity of an "API" that requires reading and parsing 2MB worth of ASCII text in order to find info on a socket.

share|improve this question
I believe that this might be more appropriate to StackOverflow, even though it is highly Linux specific. Anyway, there is a nice program called iptstate that has similar needs. You might look at how that program does it. I do not believe it uses /proc/net/tcp. – Omnifarious Nov 15 '12 at 3:55

Here is a link to libnetfilter_conntrack. You would have to re-write your program in a language that can support calling C functions from a library directly. But I think this library will have the hooks you need to get the data you want much faster than parsing through that text file.

This is what the iptstate program uses to accomplish its task.

share|improve this answer
Thank you. I will check it out, although at first glance, the interface to this lib is not clear in any way, and the documentation basically consists of a handful of cryptic example programs which do not even state what they do, and rely on an understanding of libmnl, which is itself not too clear. I do not doubt that the functionality I seek is in here, but so far it's a bit of a rathole. – ntnt Nov 15 '12 at 6:06
@ntnt: sigh I didn't look at the quality before I pointed you at it. I know it will give information about all the currently tracked connections, so yours must be in there somewhere. But, yeah, I don't know that it will give you information based on a socket id of any kind. :-( – Omnifarious Nov 15 '12 at 7:33
Note that that is about the netfilter connection tracker which has little to do with the kernel sockets. – Stéphane Chazelas Nov 15 '12 at 11:31

Netlink. Look into the ss command from the iproute2 collection.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.