Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm monitoring the TCP stack on a server hoping to generically infer problems with application on the box.

My first inclination is to measure the number of sockets in all reported states (LISTEN,ESTABLISHED,FIN_WAIT2,TIME_WAIT, etc) and detect some anomalies.

A teammate suggests that 'lsof' would be a better tool to see what state the TCP stacks are in.

Any preferences or experience tips from the serverfault crowd?

share|improve this question
Please add a *nix tag to scare away us Windows geeks – KevinH Jul 7 '09 at 16:27
up vote 7 down vote accepted

I prefer lsof because it's output is consistent across all platforms on which it runs. You can pretty much get the same info from both programs, though. I think it comes down to personal preference.

share|improve this answer

My first implication would be to use netstat -ptan which will give you all the information you are looking for. Probably pipe to sort and uniq. The following should give you a good number of socket status'.

netstat -ptan | awk '{print $6 " " $7 }' | sort | uniq -c

share|improve this answer

I think it's really more of a personal preference, as with a little tweaking (and the right command options) you can get just about the same information from either.

However, if you're wanting to monitor the number of connections in various states, I wouldn't do that with a single-shot command line tool. I'd make use of something that can do some trending so you can review it over time. Something like munin would be very useful, as it would graph it over time (along with showing you other potentially useful system statistics).

Troubleshooting an application is always easier if you have good information about the box itself and how it's performing (both during problems and when problems are absent).

share|improve this answer
The command line tool is for collection only. Your point of collecting data for a baseline is indeed the propr approach. – ericslaw Jul 13 '09 at 11:34

Check out dstat and run with:

% sudo dstat --tcp

Even better, if you want to analyze the output, you can have it write to CSV with --output.

share|improve this answer
Interesting tool, alas linux only (though understandably so). Nice to see something akin to SAR that includes network info (though linux sar versions seem to show that too). – ericslaw Jul 13 '09 at 11:31

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.