How do I view the TCP Send and Receive Queue sizes on Windows?

Question

Linux netstat shows send and receive queue sizes.

How do I get this info under Windows, specifically Server 2003?

Answer 1

(this is a bit of a brain dump)

From looking at a couple of versions of the netstat source, it seems like the information you're looking for is being queried directly from the kernel (/proc/net/...) not via socket-related calls that have Windows equivalents. If you're really determined to have this, I'd look at how it's being retrieved in netstat and see what you can find that provides something equivalent.

You should probably look at ndis.com (Network Driver Interface Specification) and PCAUSA.com for driver-level information, because that's likely to be your best place to retrieve this info on Windows.

I don't believe that getsockopt() or most of the Winsock arena is going to get you anywhere useful, but if you want to go that direction look at the MSDN Winsock information and also check out Winsock Programmer's FAQ.

For inbound, you may be able to get something useful from the ioctlsocket() function with FIONREAD to get the amount of readable data for a socket; you might not be able to get this across processes and depending on the type of data it may only return information for the first block of data not for the entire queue if there's more than one item queued.

You might do some digging on "backlog" in this context, but most of what I saw seemed to relate to setting the max size for dealing with SYN floods, not really with seeing how large the actual backlog was.

If you're really determined, you might be able to do something with your own Layered Service Provider, but that's a strange and ugly road full of perils and I'm going to suggest staying away from it.

UPDATE: After poking around a bit more, I definitely think you should look at querying NDIS OIDs. Finding the information most relevant to you is left as an exercise between you, MSDN and TechNet.

Answer 2

Have a look here: http://support.microsoft.com/kb/224829.

Answer 3

What you want might be the results of the WinSock API function calls getsockopt:

• SO_RCVBUF The total per-socket buffer space reserved for receives. This is unrelated to SO_MAX_MSG_SIZE and does not necessarily correspond to the size of the TCP receive window.

• SO_SNDBUF The total per-socket buffer space reserved for sends. This is unrelated to SO_MAX_MSG_SIZE and does not necessarily correspond to the size of a TCP send window.

The problem is that is can be asked for sockets whose handle you know. Querying from outside seems to be difficult, have a look at the sysinternals TcpView tool. Mark Russinovich is really a crack and even he does not provide the info in his tool. I am pretty sure he would have added a column if he had a mean to get the values easily...

I guess some kernel driver could help drilling down into the system but did not find any available tool. The sizes can be set on a per socket base so that global values have no meaning...

Answer 4

The closest thing I can find is the performance counter Network Interface\Output Queue Length. This isn't per-connection though - only per-interface and only covers the outbound queue (obviously, by it's name).

Answer 5

Now, the window sizes are different per socket! The settings per interface only represent the default-values.

I know of no way to view the window size of each socket. In Solaris, this can be seen with "netstat".