Instead of doing wc -l /proc/net/tcp, is there a faster way of doing it?

I just need a total count of tcp connections.

  • 5
    Maybe try ss -s – Ulrich Dangel Mar 7 '13 at 8:24
  • @UlrichDangel cool, that's faster, by reading sockstat; you can actually put that in the answer area ;-) – daisy Mar 7 '13 at 8:35

If you just want to get the number and don't need any details you can read the data from /proc/net/sockstat{,6}. Please keep in mind that you have to combine both values to get the absolute count of connections.

If you want to get the information from the kernel itself you can use NETLINK_INET_DIAG to get the information from the kernel without having to read it from /proc

  • 1
    I would be curious see a test on a system with many connections comparing the performance of my solution vs the above suggested solution which requires additional arithmetic and filtering to get the final answer, which is just a single number! – Johan Mar 8 '13 at 11:51

A faster way? That way produces an answer in a fraction of a second, in fact it takes 0.009 seconds on my computer!

Are you looking for a way that requires less typing? In that case set an alias, eg

alias tcpcount="wc -l /proc/net/tcp"

You can now just enter the aliasname, eg tcpcount is what I used in my example, to get this number.

Enter the line or add it to your .bashrc so that the alias gets defined each time you log in.

For large numbers of connections, the following can possibly run a little faster (And slightly slower for very small numbers of connections):

/usr/bin/tail -1 /proc/net/tcp | (IFS=:
echo $COUNT

Or maybe ...

awk 'END {print NR}' /proc/net/tcp

Both of these solutions assume that "wc" is not very optimal for just counting the number of lines. My testing shows that this assumption is true.

The first works on the premise that the tail command is realy good at discarding unneeded data, so much so that it makes up for creating an extra sub-shell and doing extra work on environment variables. It leverages the fact that the lines in /proc/net/tcp is already numbered to eliminate the need to count the lines. The final solution assumes that awk counts well enough to offset any disadvantage due to loading a bigger program vs creating multiple processes. The awk solution has the added benefit that it fits nicely into a simple one-line alias definition (Which gives additional benefits in that there is no script called, thus no extra shell processes forked, giving additional mili-seconds advantage.)

  • 1
    I have 40k+ connection where it takes more than 3 seconds – daisy Mar 7 '13 at 7:10
  • 2
    Hmm, I don't think there is a much faster way then reading from /proc/net/tcp. You can try netstat -n -t | wc -l, but my guess is that netstat also reads from /proc/net/tcp – Kotte Mar 7 '13 at 7:22
  • netstat is more than 3 times slower than reading /proc/net/tcp on my system, but that is with a very small number of connections, so it may be that some startup overhead gets mitigated if the number of connections is large. netstat does make it easy to get counts of connections in different states.... – Johan Mar 7 '13 at 7:41
  • 1
    On a server with 16 GB RAM, it now takes more than a minute to do a netstat -nt with about 180.000 connections. I see no reason why it should be so slow... (reading /proc/net/tcp is also very slow) – Marki555 Jan 30 '14 at 21:39
  • 1
    Some shy testing on a machine with 180k connections indicates that the awk approach is woefully slower than wc. tail seems to be on par with wc. – Felix Frank Jul 28 '14 at 15:29

Use the ss -s command to get the detailed answer.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.