Getting current TCP connection count on a system

Question

Instead of doing wc -l /proc/net/tcp, is there a faster way of doing it?

I just need a total count of tcp connections.

Solution 1

If you just want to get the number and don't need any details you can read the data from /proc/net/sockstat{,6}. Please keep in mind that you have to combine both values to get the absolute count of connections.

If you want to get the information from the kernel itself you can use NETLINK_INET_DIAG to get the information from the kernel without having to read it from /proc

Solution 2

A faster way? That way produces an answer in a fraction of a second, in fact it takes 0.009 seconds on my computer!

Are you looking for a way that requires less typing? In that case set an alias, eg

alias tcpcount="wc -l /proc/net/tcp"

You can now just enter the aliasname, eg tcpcount is what I used in my example, to get this number.

Enter the line or add it to your .bashrc so that the alias gets defined each time you log in.

For large numbers of connections, the following can possibly run a little faster (And slightly slower for very small numbers of connections):

#!/bin/bash
/usr/bin/tail -1 /proc/net/tcp | (IFS=:
read COUNT DISCARD
echo $COUNT
)

Or maybe ...

awk 'END {print NR}' /proc/net/tcp

Both of these solutions assume that "wc" is not very optimal for just counting the number of lines. My testing shows that this assumption is true.

The first works on the premise that the tail command is realy good at discarding unneeded data, so much so that it makes up for creating an extra sub-shell and doing extra work on environment variables. It leverages the fact that the lines in /proc/net/tcp is already numbered to eliminate the need to count the lines. The final solution assumes that awk counts well enough to offset any disadvantage due to loading a bigger program vs creating multiple processes. The awk solution has the added benefit that it fits nicely into a simple one-line alias definition (Which gives additional benefits in that there is no script called, thus no extra shell processes forked, giving additional mili-seconds advantage.)

Solution 3

Use the ss -s command to get the detailed answer.

Comments

[Admin]

@UlrichDangel cool, that's faster, by reading sockstat; you can actually put that in the answer area ;-)

[daisy]

I have 40k+ connection where it takes more than 3 seconds

[Kotte]

Hmm, I don't think there is a much faster way then reading from /proc/net/tcp. You can try netstat -n -t | wc -l, but my guess is that netstat also reads from /proc/net/tcp

[Johan]

netstat is more than 3 times slower than reading /proc/net/tcp on my system, but that is with a very small number of connections, so it may be that some startup overhead gets mitigated if the number of connections is large. netstat does make it easy to get counts of connections in different states....

[Johan]

@warl0ck Are you saying that 3 seconds for 40,000 connections is too slow?

[Marki555]

On a server with 16 GB RAM, it now takes more than a minute to do a netstat -nt with about 180.000 connections. I see no reason why it should be so slow... (reading /proc/net/tcp is also very slow)

[Felix Frank]

Some shy testing on a machine with 180k connections indicates that the awk approach is woefully slower than wc. tail seems to be on par with wc.