Special Edition Using Linux, Fourth Edition:Configuring a TCP/IP Network

-->

The second section displays active UNIX domain sockets. UNIX domain sockets are an IPC (interprocess communication) mechanism that uses the UNIX file system as the rendezvous system. Processes create special files in the file system that are then opened by other processes on the machine that wants to communicate. The preceding netstat listing shows two sockets listening: one on /dev/printer and the other on /dev/log. There are also two currently connected sockets: one to /dev/log and one which has no specified path associated with it. Table 24.8 describes the fields in the Active UNIX Domain Sockets listing.

**Table 24.8** Fields in the Active UNIX Domain Sockets Listing

Field	Description

`Proto`	The protocol in use on this socket. This will usually be `unix.`
`RefCnt`	The number of processes attached to this socket.
`Flags`	The flags for this socket. Now, the only known flag is `SO_ACCEPTON` (`ACC` ), which indicates that the socket is unconnected and the process that made the socket is waiting for a connection request.
`Type`	The mode in which the socket is accessed. This field will contain one of the following keywords:
	`OCK_DGRAM`	Datagram, connectionless mode
	`OCK_STREAM`	Connection-oriented stream mode
	`OCK_RAW`	Raw mode
	`OCK_RDM`	Reliably delivered message mode
	`OCK_SEQPACKET`	Sequential packet mode
	`NKNOWN`	Mode not known to `netstat` program
`State`	The current state of the socket. The following keywords are used:
	`FREE`	The socket isn’t allocated.
	`LISTENING`	The socket is waiting for a connection request.
	`UNCONNECTED`	There’s no current connection on the socket.
	`CONNECTING`	The socket is attempting to make a connection.
	`CONNECTED`	The socket has a current connection.
	`DISCONNECTING`	The socket is attempting to shut down a connection.
	`UNKNOWN`	The state of the socket is unknown. You won’t see this under normal operating conditions.
`Path`	This is the path name used by other processes to connect to the socket.

TIP: Network interfaces that drop many packets or are getting many overrun errors can be a symptom of an overloaded machine or network. Checking the network interface statistics is a quick way of diagnosing this problem.

Invoking netstat with the -o option adds the internal state information to the Active Internet Connections listing. The following is an example of this:


$ netstat -o

Active Internet connections

Proto Recv-Q Send-Q Local Address       Foreign Address       (State)

tcp        0      0 localhost:1121      localhost:telnet      ESTABLISHED

off (0.00/0)

tcp        0      0 localhost:telnet    localhost:1121        ESTABLISHED

on  (673.69/0)

The added data is at the end of each line and includes receiver retransmission byte count, transmitter retransmission byte count, timer state (on/off), and time/backoff values (in parentheses). The time displayed is the time left before the timer expires. The backoff is the retry count for the current data transmission. This data is useful in diagnosing network problems by making it easy to see which connection is having problems.

NOTE: Because the -o option outputs the state of internal TCP/IP data, the format of this data may change or this option may be removed in a later release of the networking software.

Examining the Kernel Routing Table

Invoking netstat with the -r option prints out the kernel routing table. The format is the same as for the route command.

Displaying Network Interface Statistics

Invoking netstat with the -i option prints out usage statistics for each active network interface—another excellent tool for debugging network problems. With this command, it’s very easy to see when packets are being dropped, overrun, and so on.

Table of Contents