How do I check how many connections are open currently on a specific TCP port?

Question

I'm doing some comet benchmarks and would like to see how many open connections I have.

Actually I use netstat:

netstat -ant | grep 8080 | grep EST | wc -l

But it needs around 4-6 minutes to list the number, is there any tool that can do show it in real time? The number of open connections is between 100'000 - 250'000.

Solution 1

Don't know if lsof is better, but give this a try:

lsof -ni:8080 -sTCP:ESTABLISHED | wc -l

Solution 2

If you just need to see connecton statistics, try ss utility from iproute suite:

# ss -s
Total: 1788 (kernel 3134)
TCP:   1638 (estab 1409, closed 162, orphaned 0, synrecv 0, timewait 127/0), ports 0

Transport Total     IP        IPv6
*         3134      -         -        
RAW       0         0         0        
UDP       74        69        5        
TCP       1476      1444      32       
INET      1550      1513      37       
FRAG      0         0         0     

You also can view detailed information on all established connections like this:

ss -n state established

…or ssh connections only:

ss -n state established '( dport = :ssh or sport = :ssh )'

Some numbers section at the bottom of this page may also interest you.

Solution 3

Another option would be to read /proc/net/tcp directly. To see all established TCP connections on, 8080, you would do something like

$ printf %04X 8080
1F90
$ grep :1F90 /proc/net/tcp | grep ' 01 ' | wc -l

If you want to do it in a single process (less IO overhead) and handle corner cases, the following tells you how many ESTABLISHED TCP connections have local port 8080:

$ perl -anle '
          $F[1] =~ /:1F90/ and $F[3] =~ /01/ and $cnt++;
          END { print 0+$cnt }
         '  /proc/net/tcp

If the software on your machine listening on 8080 has IPv6 support, you'll need to read /proc/net/tcp6 also; if the program's using IPv6 sockets, connections will show up there even if they're using IPv4.

Comments

[SpacemanSpiff]

Based on what you're trying to accomplish, have you considered using NetFlow and an analyzer tool?

[Nenad]

@SpacemanSpiff I hope there is some easy solution, but I will take a look on NetFlow as I'm not sure if is working with a HP switch.

[SpacemanSpiff]

You know, I wonder if a perfmon or WMI query might bring this data back from the TCP stack faster... still... are you after open ports or active data transfers?

[Nenad]

@SpacemanSpiff I'm after open ports looking

[SpacemanSpiff]

Maybe an SNMP query?... just throwing out ideas for you.

[Nenad]

@SpacemanSpiff lsof as proposed by ThorstenS was able to show me the number of open connections in 15 sec for above 130'000 open connections. In a next step I will take more detailed information with the use of a network analyzer, for now I'm happy to know where the limit for 1 node.js on a tuned server is -> 130599 connections for 1 instance which is really well :-)

[Nenad]

actually lsof take 5 sec, but I have 20'000 connections and counting :-) will let you know how long after pass 100K

[Nenad]

update: have some issues with our comet clients, but lsof is much faster 10 sec for 30'000 connections, will update after I fixed the comet issues and was able to check above 100K connections

[Nenad]

update: 15sec to show 130'000 connections - thank you! This do the job for me for more detailed solution a network analyzer must be used.

[ThorstenS]

wonderfull! You could also use the switch -t - perhaps this will give you also a little boost.

[Jenny D]

This will take longer since you're not using the "n" flag to stop it from looking up all hostnames. It will also show other things than the port 8080 connections that the question was about.

[Joshua Griffiths]

+1 for not using the deprecated netstat

[RobertRSeattle]

I know this is from 6 years ago, but do you or anyone else have a link to something that breaks down the ss status output. I'm specifically curious about the port count at the end of the TCP line. I'm doing some comparison testing between two servers acting as load balancers and on one the port count hovers around 1000 and on the other it's always 0. What specifically is that counting?

[artyom]

@RobertRSeattle by ss source code it seems that this number is read from tcp_bind_bucket line of /proc/slabinfo file. You may want to compare output of awk 'NR==2||/tcp_bind_bucket/' /proc/slabinfo between two of your servers. Further details can likely be found somewhere in kernel sources.