From owner-freebsd-stable@FreeBSD.ORG Thu May 3 18:28:56 2007 Return-Path: X-Original-To: freebsd-stable@freebsd.org Delivered-To: freebsd-stable@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52]) by hub.freebsd.org (Postfix) with ESMTP id AFF4E16A403; Thu, 3 May 2007 18:28:56 +0000 (UTC) (envelope-from rwatson@FreeBSD.org) Received: from cyrus.watson.org (cyrus.watson.org [209.31.154.42]) by mx1.freebsd.org (Postfix) with ESMTP id 851AB13C448; Thu, 3 May 2007 18:28:56 +0000 (UTC) (envelope-from rwatson@FreeBSD.org) Received: from fledge.watson.org (fledge.watson.org [209.31.154.41]) by cyrus.watson.org (Postfix) with ESMTP id 3321E46CD2; Thu, 3 May 2007 14:28:56 -0400 (EDT) Date: Thu, 3 May 2007 19:28:56 +0100 (BST) From: Robert Watson X-X-Sender: robert@fledge.watson.org To: "Marc G. Fournier" In-Reply-To: <7F7C3ECEFCC7914576DA2033@ganymede.hub.org> Message-ID: <20070503192409.W32808@fledge.watson.org> References: <366565EAE2F989935287015E@ganymede.hub.org> <7F7C3ECEFCC7914576DA2033@ganymede.hub.org> MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed Cc: Adrian Chadd , freebsd-stable@freebsd.org Subject: Re: What triggers "No Buffer Space Available"? X-BeenThere: freebsd-stable@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Production branch of FreeBSD source code List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 03 May 2007 18:28:56 -0000 On Wed, 2 May 2007, Marc G. Fournier wrote: > # netstat | egrep "tcp4|udp4" | awk '{print $1}' | uniq -c > 171 tcp4 > 103 udp4 > > or is there a better command I should be using? I generally recommend using a combination of netstat and sockstat. Sockets represent, loosely, IPC endpoints. There are actually two "layers" associated with each socket -- the IPC object (socket) and the protocol control block (PCB). Both are resource limited to pevent run-away processes from swamping the system, so exhaustion of either can lead to ENOBUFS. The behaviors of netstat and sockstat are quite different, even though the output is similar: netstat walks the protocol-layer connection lists and prints information about them. sockstat walks the process file descriptor table and prints information on reachable sockets. As sockets can exist without PCBs, and PCBs can exist without sockets, you need to look at both to get a full picture. This can occur if a proces exits, closes the socket, and the connection remains in, for example, the TIME_WAIT state. There are some other differences -- the same socket can appear more than once in sockstat output, as more than one process can reference the same socket. Sockets can also exist without any referencing process (if the application closes, but there is still data draining on an open socket). I would suggest starting with sockstat, as that will allow you to link socket use to applications, and provide a fairly neat summary. When using netstat, use "netstat -na", which will list all sockets and avoid name lookups. Robert N M Watson Computer Laboratory University of Cambridge