Simple kernel module to inspect socket options
C Makefile
Switch branches/tags
Nothing to show
Clone or download
Fetching latest commit…
Cannot retrieve the latest commit at this time.
Failed to load latest commit information.



knetstat is a simple Linux kernel module that adds four new files to /proc/net: tcpstat, tcp6stat, udpstat and udp6stat. The content of these files is roughly equivalent to the output of netstat with options -t4an, -t6an, -u4an and -u6an respectively, i.e. they provide information about TCP and UDP sockets in human readable form. The difference with the corresponding netstat output is that they have an additional column that displays (a subset of) the socket options. This was the primary motivation for writing the knetstat kernel module: currently, on Linux there is no way for an administrator to inspect the options set on a socket created by some process (other than using strace or an equivalent tool on that process at socket creation/configuration time), because this information is not exposed through the /proc file system.

knetstat internally reuses the infrastructure that is used by the kernel to generate the content of the /proc/net/tcp, /proc/net/tcp6, /proc/net/udp and /proc/net/udp6 files. This means that there is a one-to-one correspondence between the entries in these files and the entries in the files generated by knetstat. Only the formatting and information content is different between the two.

Here is some sample output:

$ cat /proc/net/tcpstat 
Recv-Q Send-Q Local Address           Foreign Address         Stat Diag Options
     0      0*               LSTN      SO_REUSEADDR=1,SO_KEEPALIVE=0,TCP_NODELAY=0
     0      0    *               LSTN      SO_REUSEADDR=1,SO_KEEPALIVE=0,TCP_NODELAY=0
     0      0       ESTB      SO_REUSEADDR=1,SO_KEEPALIVE=1,TCP_NODELAY=1
     0      0         ESTB      SO_REUSEADDR=1,SO_KEEPALIVE=0,TCP_NODELAY=1
     0      0          ESTB      SO_REUSEADDR=0,SO_KEEPALIVE=1,TCP_NODELAY=1

The "Diag" column can display the following diagnostic indicators:

Indicator Meaning
>| The sender window (i.e. the window advertised by the remote endpoint) is 0. No data can be sent to the peer.
|< The receiver window (i.e. the window advertised by the local endpoint) is 0. No data can be received from the peer.
># There are unacknowledged packets and the last ACK was received more than one second ago. This may be an indication that there are network problems or that the peer crashed.

Currently supported features

  • Protocols: TCP and UDP (IPv4 and IPv6)


The current knetstat code has been successfully tested with kernel versions 3.13, 3.18, 4.4, 4.8 and 4.9. It may work with other versions as well.


To build the module, ensure that you have the headers for the currently running kernel as well as the basic build tools such as make and GCC. E.g. on Ubuntu:

# apt-get install linux-headers-$(uname -r) make gcc

Then check out the knetstat source code and execute make. This should create knetstat.ko which can be loaded using insmod.

Notes for Java developers

The following table shows the correspondence between socket options reported by knetstat and setter methods defined by the class. This information can be used to infer the configuration that a Java process applied to a instance based on the output of knetstat. The mapping is straightforward, except for setSoTimeout.

Java method Socket option reported by knetstat
setReceiveBufferSize SO_RCVBUF
setReuseAddress SO_REUSEADDR
setSendBufferSize SO_SNDBUF
setSoLinger SO_LINGER
setSoTimeout none [*]

[*] In contrast to what the Javadoc suggests, the setSoTimeout method doesn't actually set any socket option on Linux. By default, instances are backed by (even if no SOCKS proxy is configured). This class extends which stores the timeout internally for later use by the read methods in They in turn pass the timeout to an invocation of the poll system call that waits until data is available for reading (or an error occurs).