Given a linux TCP socket's inode (obtained via /proc/<pid>/fd), is there a faster way to look up the information that I can get from /proc/net/tcp about this socket?

I have written a troubleshooting tool which monitors processes and prints realtime information about IO operations (strace-type info collected into higher level abstractions and presented in a less raw way), but on a heavily loaded network server, I am finding that the time it takes to look up socket info (e.g. the foreign address/port) is prohibitive simply due to the very large size of /proc/net/tcp (about 2MB on the server I'm currently looking at).

I can manage this somewhat with caching, but this necessarily introduces latency and makes me wonder about the absurdity of an "API" that requires reading and parsing 2MB worth of ASCII text in order to find info on a socket.

  • I believe that this might be more appropriate to StackOverflow, even though it is highly Linux specific. Anyway, there is a nice program called iptstate that has similar needs. You might look at how that program does it. I do not believe it uses /proc/net/tcp. – Omnifarious Nov 15 '12 at 3:55

Here is a link to libnetfilter_conntrack. You would have to re-write your program in a language that can support calling C functions from a library directly. But I think this library will have the hooks you need to get the data you want much faster than parsing through that text file.

This is what the iptstate program uses to accomplish its task.

  • 1
    Thank you. I will check it out, although at first glance, the interface to this lib is not clear in any way, and the documentation basically consists of a handful of cryptic example programs which do not even state what they do, and rely on an understanding of libmnl, which is itself not too clear. I do not doubt that the functionality I seek is in here, but so far it's a bit of a rathole. – ntnt Nov 15 '12 at 6:06
  • 1
    @ntnt: sigh I didn't look at the quality before I pointed you at it. I know it will give information about all the currently tracked connections, so yours must be in there somewhere. But, yeah, I don't know that it will give you information based on a socket id of any kind. :-( – Omnifarious Nov 15 '12 at 7:33
  • 1
    Note that that is about the netfilter connection tracker which has little to do with the kernel sockets. – Stéphane Chazelas Nov 15 '12 at 11:31
  • @StéphaneChazelas - Yeah... it's weird to me how netlink can't do anything with netfilter. netfilter itself is some kind of weird interface using the [sg]etsockopt garbage pail system calls. I've had to learn a lot more about this for some work I've done recently. I suspect netlink is a much better choice for the info the OP wanted. – Omnifarious Jan 13 '18 at 5:11

Netlink. Look into the ss command from the iproute2 collection.

Here is the code base for iproute2 and ss is described here.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.