CODEWITHSUNDEEP
linuxsockets
Tim
Tim

Reputation: 99398

What is the system call(s) which retrieves the states of sockets in netstat?

What is the system call(s) which retrieves the states of sockets in netstat? I am not actually interested in how netstat is implemented, but in what system call(s) can retrieve that information. getsockopt() seems to get the static information of sockets, not the dynamic/running states of sockets.

ss and netstat seem to take different approaches, according to what iproute document says:

This utility presents a new approach, which is supposed to scale well. I am not going to describe technical details here and will concentrate on description of the command. The only important thing to say is that it is not so bad idea to load module tcp_diag, which can be found in directory Modules of iproute2. If you do not make this ss will work, but it falls back to /proc and becomes slow like netstat, well, a bit faster yet (see section "Some numbers").

Does ss use some system calls to get the running states of sockets?

Upvotes: 1

Views: 917

Answers (1)

cherusk
cherusk

Reputation: 31

It's using the "netlink protocol" to accrue the data from the network stack, the transport layer engines within the kernel.

The netlink protocol is more generic than that, so not only covering socket stats for completeness sake.

For sockets specifically it's the [http://man7.org/linux/man-pages/man7/sock_diag.7.html][sockdiag] subsystem.

There are also more recent implementations of ss, e.g. [https://github.com/svinota/pyroute2/blob/master/cli/ss2][ss2] in python. From there, perusing it, getting a gist is simpler.

Cheers.

Upvotes: 2

Related Questions