From owner-freebsd-stable@freebsd.org  Thu Dec 15 16:05:59 2016
Return-Path: <owner-freebsd-stable@freebsd.org>
Delivered-To: freebsd-stable@mailman.ysv.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org
 [IPv6:2001:1900:2254:206a::19:1])
 by mailman.ysv.freebsd.org (Postfix) with ESMTP id 8ABF1C8191E;
 Thu, 15 Dec 2016 16:05:59 +0000 (UTC)
 (envelope-from gpalmer@freebsd.org)
Received: from mail.in-addr.com (mail.in-addr.com
 [IPv6:2a01:4f8:191:61e8::2525:2525])
 (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
 (Client did not present a certificate)
 by mx1.freebsd.org (Postfix) with ESMTPS id 5632B18EE;
 Thu, 15 Dec 2016 16:05:59 +0000 (UTC)
 (envelope-from gpalmer@freebsd.org)
Received: from gjp by mail.in-addr.com with local (Exim 4.87 (FreeBSD))
 (envelope-from <gpalmer@freebsd.org>)
 id 1cHYXd-0007KH-1y; Thu, 15 Dec 2016 16:05:57 +0000
Date: Thu, 15 Dec 2016 16:05:57 +0000
From: Gary Palmer <gpalmer@freebsd.org>
To: Artem Viklenko <artem@viklenko.net>
Cc: Eugene Grosbein <egrosbein@rdtc.ru>, freebsd-net <freebsd-net@freebsd.org>,
 "Eugene M. Zheganin" <emz@norma.perm.ru>,
 freebsd-stable@freebsd.org, owner-freebsd-net@freebsd.org
Subject: Re: sonewconn: pcb [...]: Listen queue overflow to human-readable form
Message-ID: <20161215160557.GC7032@in-addr.com>
References: <58528B50.8030600@norma.perm.ru> <58528C6B.8070800@rdtc.ru>
 <7f33d47e2014d9c994f8b2003b011ba3@mail.viklenko.net>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <7f33d47e2014d9c994f8b2003b011ba3@mail.viklenko.net>
X-SA-Exim-Connect-IP: <locally generated>
X-SA-Exim-Mail-From: gpalmer@freebsd.org
X-SA-Exim-Scanned: No (on mail.in-addr.com); SAEximRunCond expanded to false
X-BeenThere: freebsd-stable@freebsd.org
X-Mailman-Version: 2.1.23
Precedence: list
List-Id: Production branch of FreeBSD source code <freebsd-stable.freebsd.org>
List-Unsubscribe: <https://lists.freebsd.org/mailman/options/freebsd-stable>, 
 <mailto:freebsd-stable-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-stable/>
List-Post: <mailto:freebsd-stable@freebsd.org>
List-Help: <mailto:freebsd-stable-request@freebsd.org?subject=help>
List-Subscribe: <https://lists.freebsd.org/mailman/listinfo/freebsd-stable>,
 <mailto:freebsd-stable-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Thu, 15 Dec 2016 16:05:59 -0000

On Thu, Dec 15, 2016 at 05:27:02PM +0200, Artem Viklenko wrote:
> 2016-12-15 14:28, Eugene Grosbein ??????????????:
> > On 15.12.2016 19:23, Eugene M. Zheganin wrote:
> > 
> >> but at the time of investigation the socket is already closed and lsof
> >> cannot show me the owner. I wonder if the kernel can itself decode 
> >> this
> >> output and write it in the human-readable form ?
> > 
> > Until that's not implemented, you can monitor "netstat -Lan" output and
> > continuously save it for later analisys and/or draw graphs.
> > 
> 
> netstat -LanA -f inet ?

That's only IPv4 sockets (or sockets that are listening on both families
at the same time).  If you are dual stack with IPv6, you'd probably also
need to capture

netstat -LanA -f inet6

Regards,

Gary