Download your favorite Linux distribution at LQ ISO.
Go Back > Forums > Linux Forums > Linux - Networking
User Name
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.


  Search this Thread
Old 12-13-2010, 04:20 PM   #1
LQ Newbie
Registered: Nov 2004
Posts: 17

Rep: Reputation: 0
Question What is TCP orphan in in /proc/net/sockstat

Hello all,

Does anyone know what orphan field for TCP is in /proc/net/sockstat?

I search the web, and best I can find is some guesses that it's established TCP connections "not attached to any file handle".

Does anyone know more specifically what it is? E.g. if I were programming, how would I go about generating orphans? (Not that I want to accomplish it, just curious).

Also, any input on other fields in that file would be golden.

Old 12-14-2010, 08:49 AM   #2
Registered: Jun 2005
Distribution: OpenSUSE 10.3 , 11.2 , Solaris 10, Ubuntu 9.10
Posts: 84

Rep: Reputation: 16
Lightbulb May be this is the explanation (I may be wrong)

I'm not an expert of kernel code... but that number came from tcp_orphan_count
(ref: )

net/ipv4/proc.c in a 2.6 kernel. At line 56-66 the following code:
static int sockstat_seq_show(struct seq_file *seq, void *v)
seq_printf(seq, "TCP: inuse %d orphan %d tw %d alloc %d mem %d\n",fold_prot_inuse(&tcp_prot), atomic_read(&tcp_orphan_count),tcp_tw_count, atomic_read(&tcp_sockets_allocated), atomic_read(&tcp_memory_allocated));
few usage I got are these (find in file): (kernel

in tcp.c file:
atomic_t tcp_orphan_count = ATOMIC_INIT(0); (declaration)
so tcp_orphan_count it is a global counter variable initialized to 0 (in tcp_ipv4.c)

struct proto tcp_prot{

.orphan_count = &tcp_orphan_count

and this .orphan_count is replicated in each socket struct variable's sk->sk_prot member variable.

This global variable is incremented in listen call in function inet_csk_listen_stop(struct sock *sk) as:
and this function internally calls inet_csk_destroy_sock() given below,

It is decremented in inet_csk_destroy_sock(struct sock *sk):
[after some validation check] ...

So the global tcp orphan counter will increase only if during this synchronization is lost , due to bug/assert failure or due to TCP out of memory when malloc() fails somewhere and the socket is terminated prematurely .

There is a internal TCP timer that checks for some bug/error, and if it finds that the Orphan counter EXCEEDED a preconfigured limit then it starts to reclaim some memory by freeing some unused sockets.

One comment I found that highlights above point (in tcp_timer.c)
/* Do not allow orphaned sockets to eat all our resources.
* This is direct violation of TCP specs, but it is required
* to prevent DoS attacks. It is called when a retransmission timeout
* or zero probe timeout occurs on orphaned socket.
* Criteria is still not confirmed experimentally and may change.
* We kill the socket, if:
* 1. If number of orphaned sockets exceeds an administratively configured
* limit.
* 2. If we have strong memory pressure.
static int tcp_out_of_resources(struct sock *sk, int do_reset)

So to manually create orphan socket requires direct/indirect tampering of skb structure or DoS attack (
1 members found this post helpful.


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off

Similar Threads
Thread Thread Starter Forum Replies Last Post
what is "FRAG" in "/proc/net/sockstat" ? dileepkk Linux - Networking 1 06-21-2011 11:16 AM
/proc/net/tcp - retransmit vlyamtse Linux - Networking 0 02-26-2010 10:48 AM
getting ports (tcp, udp) from /proc kbarani Linux - Software 1 03-27-2009 04:00 AM
/proc/net/dev_mcast vprakash Linux - Networking 1 09-21-2007 01:03 PM
/proc/dev/net and /proc/net/dev problem ! Linux.tar.gz Slackware 1 05-23-2007 05:24 AM > Forums > Linux Forums > Linux - Networking

All times are GMT -5. The time now is 09:28 PM.

Main Menu
Write for LQ is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration