On Wed, 2 May 2007, Marc G. Fournier wrote:
# netstat | egrep "tcp4|udp4" | awk '{print $1}' | uniq -c
171 tcp4
103 udp4
or is there a better command I should be using?
I generally recommend using a combination of netstat and sockstat. Sockets
represent, loosely, IPC endpoints. There are actually two "layers" associated
with each socket -- the IPC object (socket) and the protocol control block
(PCB). Both are resource limited to pevent run-away processes from swamping
the system, so exhaustion of either can lead to ENOBUFS.
The behaviors of netstat and sockstat are quite different, even though the
output is similar: netstat walks the protocol-layer connection lists and
prints information about them. sockstat walks the process file descriptor
table and prints information on reachable sockets. As sockets can exist
without PCBs, and PCBs can exist without sockets, you need to look at both to
get a full picture. This can occur if a proces exits, closes the socket, and
the connection remains in, for example, the TIME_WAIT state.
There are some other differences -- the same socket can appear more than once
in sockstat output, as more than one process can reference the same socket.
Sockets can also exist without any referencing process (if the application
closes, but there is still data draining on an open socket).
I would suggest starting with sockstat, as that will allow you to link socket
use to applications, and provide a fairly neat summary. When using netstat,
use "netstat -na", which will list all sockets and avoid name lookups.
Robert N M Watson
Computer Laboratory
University of Cambridge
_______________________________________________
freebsd-stable@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-stable
To unsubscribe, send any mail to "[EMAIL PROTECTED]"
