Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

What's the exact meaning of Send Buffer byte count in the extended netstat statistics, and why is it always bigger than Send-Q?

In other words, what's counted against the S-BCNT that's not counted against the Send-Q?

Is S-BCNT a better number to use to figure the cost to the system of a particular connection?

share|improve this question
up vote 1 down vote accepted

You can find definition along with comments at sys/sys/sockbuf.h:

    u_int   sb_cc;      /* (c/d) actual chars in buffer */
    u_int   sb_mbcnt;   /* (c/d) chars of mbufs used */

BSDs are using structures called mbuf/mbuf_cluster for network data. They used everywhere from driver code to socket layer. Even if packet had 1 byte of payload it will consume 256 (mbuf) bytes in mbuf. If packet size (with all frame/packet headers) >= 256 it will consume 256 (mbuf) + 2048 (mbuf_cluster) bytes. Hence the difference between sb_cc and sb_mbcnt.

To answer your question: S-BCNT is more correct value to use.

PS. For more information consult to TCP/IP Illustrated Volume 2 - W. Richard Stevens and Garry R. Wright, Chapter 16 - Socket I/O, Section 16.3 - Socket Buffers, p.476

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.