Request¶

The request starts with a struct nlmsghdr header described in netlink(7) with nlmsg_type field set to SOCK_DIAG_BY_FAMILY. It is followed by a header specific to the address family that starts with a common part shared by all address families:

struct sock_diag_req {


    __u8 sdiag_family;


    __u8 sdiag_protocol;
};

The fields of this structure are as follows:

sdiag_family

An address family. It should be set to the appropriate AF_* constant.

sdiag_protocol

Depends on sdiag_family. It should be set to the appropriate IPPROTO_* constant for AF_INET and AF_INET6, and to 0 otherwise.

If the nlmsg_flags field of the struct nlmsghdr header has the NLM_F_DUMP flag set, it means that a list of sockets is being requested; otherwise it is a query about an individual socket.

Response¶

The response starts with a struct nlmsghdr header and is followed by an array of objects specific to the address family. The array is to be accessed with the standard NLMSG_* macros from the netlink(3) API.

Each object is the NLA (netlink attributes) list that is to be accessed with the RTA_* macros from rtnetlink(3) API.

UNIX domain sockets¶

For UNIX domain sockets the request is represented in the following structure:

struct unix_diag_req {


    __u8    sdiag_family;


    __u8    sdiag_protocol;


    __u16   pad;


    __u32   udiag_states;


    __u32   udiag_ino;


    __u32   udiag_show;


    __u32   udiag_cookie[2];
};

The fields of this structure are as follows:

sdiag_family

The address family; it should be set to AF_UNIX.

sdiag_protocol

pad

These fields should be set to 0.

udiag_states

This is a bit mask that defines a filter of sockets states. Only those sockets whose states are in this mask will be reported. Ignored when querying for an individual socket. Supported values are:

udiag_ino

This is an inode number when querying for an individual socket. Ignored when querying for a list of sockets.

udiag_show

This is a set of flags defining what kind of information to report. Each requested kind of information is reported back as a netlink attribute as described below:

udiag_cookie

This is an array of opaque identifiers that could be used along with udiag_ino to specify an individual socket. It is ignored when querying for a list of sockets, as well as when all its elements are set to -1.

The response to a query for UNIX domain sockets is represented as an array of

struct unix_diag_msg {


    __u8    udiag_family;


    __u8    udiag_type;


    __u8    udiag_state;


    __u8    pad;


    __u32   udiag_ino;


    __u32   udiag_cookie[2];
};

followed by netlink attributes.

The fields of this structure are as follows:

udiag_family

This field has the same meaning as in struct unix_diag_req.

udiag_type

This is set to one of SOCK_PACKET, SOCK_STREAM, or SOCK_SEQPACKET.

udiag_state

This is set to one of TCP_LISTEN or TCP_ESTABLISHED.

pad

This field is set to 0.

udiag_ino

This is the socket inode number.

udiag_cookie

This is an array of opaque identifiers that could be used in subsequent queries.

IPv4 and IPv6 sockets¶

For IPv4 and IPv6 sockets, the request is represented in the following structure:

struct inet_diag_req_v2 {


    __u8    sdiag_family;


    __u8    sdiag_protocol;


    __u8    idiag_ext;


    __u8    pad;


    __u32   idiag_states;


    struct inet_diag_sockid id;
};

where struct inet_diag_sockid is defined as follows:

struct inet_diag_sockid {


    __be16  idiag_sport;


    __be16  idiag_dport;


    __be32  idiag_src[4];


    __be32  idiag_dst[4];


    __u32   idiag_if;


    __u32   idiag_cookie[2];
};

The fields of struct inet_diag_req_v2 are as follows:

sdiag_family

This should be set to either AF_INET or AF_INET6 for IPv4 or IPv6 sockets respectively.

sdiag_protocol

This should be set to one of IPPROTO_TCP, IPPROTO_UDP, or IPPROTO_UDPLITE.

idiag_ext

This is a set of flags defining what kind of extended information to report. Each requested kind of information is reported back as a netlink attribute as described below:

pad

This should be set to 0.

idiag_states

This is a bit mask that defines a filter of socket states. Only those sockets whose states are in this mask will be reported. Ignored when querying for an individual socket.

id

This is a socket ID object that is used in dump requests, in queries about individual sockets, and is reported back in each response. Unlike UNIX domain sockets, IPv4 and IPv6 sockets are identified using addresses and ports. All values are in network byte order.

The fields of struct inet_diag_sockid are as follows:

idiag_sport

The source port.

idiag_dport

The destination port.

idiag_src

The source address.

idiag_dst

The destination address.

idiag_if

The interface number the socket is bound to.

idiag_cookie

This is an array of opaque identifiers that could be used along with other fields of this structure to specify an individual socket. It is ignored when querying for a list of sockets, as well as when all its elements are set to -1.

The response to a query for IPv4 or IPv6 sockets is represented as an array of

struct inet_diag_msg {


    __u8    idiag_family;


    __u8    idiag_state;


    __u8    idiag_timer;


    __u8    idiag_retrans;


    struct inet_diag_sockid id;


    __u32   idiag_expires;


    __u32   idiag_rqueue;


    __u32   idiag_wqueue;


    __u32   idiag_uid;


    __u32   idiag_inode;
};

followed by netlink attributes.

The fields of this structure are as follows:

idiag_family

This is the same field as in struct inet_diag_req_v2.

idiag_state

This denotes socket state as in struct inet_diag_req_v2.

idiag_timer

For TCP sockets, this field describes the type of timer that is currently active for the socket. It is set to one of the following constants:

For non-TCP sockets, this field is set to 0.

idiag_retrans

For idiag_timer values 1, 2, and 4, this field contains the number of retransmits. For other idiag_timer values, this field is set to 0.

idiag_expires

For TCP sockets that have an active timer, this field describes its expiration time in milliseconds. For other sockets, this field is set to 0.

idiag_rqueue

For listening sockets: the number of pending connections.

For other sockets: the amount of data in the incoming queue.

idiag_wqueue

For listening sockets: the backlog length.

For other sockets: the amount of memory available for sending.

idiag_uid

This is the socket owner UID.

idiag_inode

This is the socket inode number.

Socket memory information¶

The payload associated with UNIX_DIAG_MEMINFO and INET_DIAG_SKMEMINFO netlink attributes is an array of the following __u32 values:

SK_MEMINFO_RMEM_ALLOC

The amount of data in receive queue.

SK_MEMINFO_RCVBUF

The receive socket buffer as set by SO_RCVBUF.

SK_MEMINFO_WMEM_ALLOC

The amount of data in send queue.

SK_MEMINFO_SNDBUF

The send socket buffer as set by SO_SNDBUF.

SK_MEMINFO_FWD_ALLOC

The amount of memory scheduled for future use (TCP only).

SK_MEMINFO_WMEM_QUEUED

The amount of data queued by TCP, but not yet sent.

SK_MEMINFO_OPTMEM

The amount of memory allocated for the socket's service needs (e.g., socket filter).

SK_MEMINFO_BACKLOG

The amount of packets in the backlog (not yet processed).