linux-networkingtcp
Is there any way to lookup the send/receive buffer sizes for TCP sockets?
I've poked around with both netstat and ss, as well as the raw /proc/net/tcp. Lots of goodies there, including the counts of bytes in flight, timers, process name, etc.
But I'd like to be able to diagnose whether some proceses are setting SO_{SND,RCV}BUF…and more interestingly what values the kernel is actually using for each SKB.
If there are processes binding to INADDR_ANY, then some systems will try to pick ports only from the range of 49152 to 65535. That could account for your ~15k limit as the range is exactly 16384 ports.
You may be able to expand that range by finding the instructions for your OS here:
The window size in the TCP header reflects the size of the remaining buffer on each end. You can graph this using Wireshark to both capture and analyze traffic (This isn't real time, but is usually how this sort of thing is done). Choose Custom IO Graph under Statistics and do something like the following (You need to choose Advanced for the Y-Axis):
The above graphs the window size for all packets where the source address in the packet is 10.7.0.127.
Best Answer
From the lsof FAQ (search for "Why doesn't lsof report socket options"), I believe Linux doesn't make the info you're after available. (at least not via /proc)
If it did, you could use
lsof -i <pid> -a -i tcp -T f, but -T only takes "qs", not f on Linux. You can get some other info from netstat (netstat --tcp -p -o -e -e -v | grep <pid>) which includes the Send Queue and Receive Queue and some timer info.What you could do is use strace. You'd have to either run the program via strace (
strace -ff -e network,ioctl PROGRAM) or before it sets up the TCP socket (strace -fff -e network,ioctl -p PID).ioctlis how those options would be set, andnetworkshould catch enough to tell what connections those are. (but just ioctl and then use lsof to figure out where the connections to should work, too)