determine the current number of backlogged connections in tcp listen() queue

Here's a little Python hack that will get that figure for you for a given listening port:

!/usr/bin/python

import sys

STATE_SYN_RECV = '03'

def count_state(find_port, find_state):
count = 0
with open('/proc/net/tcp', 'r') as f:
first = True
for line in f:
if first:
first = False
continue
entries = line.split()
local_addr, local_port = entries[1].split(':')
local_port = int(local_port, 16)
if local_port != find_port:
continue
state = entries[3]
if state == find_state:
count += 1
return count


if __name__ == '__main__':
if len(sys.argv) != 2:
print "Usage: count_syn_recv.py <port>"
   sys.exit(1)

   port = int(sys.argv[1])

   count = count_state(port, STATE_SYN_RECV)
   print "syn_recv_count=%d" % count

You can look at the unacked value in the output of ss, for example when examining port 80:

ss - lti '( sport = :http )'

The output could look like this:

State Recv - Q Send - Q Local Address: Port Peer Address: Port
LISTEN 123 0::: http::: *
   rto: 0.99 mss: 536 cwnd: 10 unacked: 123

Suggestion : 2

If socket is established, Recv-Q and Send-Q means bytes as it's described in documentation. If socket is listening, Recv-Q means current queue size, and Send-Q means configured backlog.,Going deeper into mans gives us folowing in sock_diag(7):, However on my CentOS 7.4 only ss shows correct Send-Q (i. e. backlog, listen/accept queue) value for listening socket, but netstat doesn't – Pavel Timofeev Sep 21, 2017 at 12:32 , By clicking “Accept all cookies”, you agree Stack Exchange can store cookies on your device and disclose information in accordance with our Cookie Policy.

net/ipv4/tcp_diag.c:

if (sk - > sk_state == TCP_LISTEN) {
   r - > idiag_rqueue = sk - > sk_ack_backlog;
   r - > idiag_wqueue = sk - > sk_max_ack_backlog;
} else {
   r - > idiag_rqueue = max_t(int, tp - > rcv_nxt - tp - > copied_seq, 0);
   r - > idiag_wqueue = tp - > write_seq - tp - > snd_una;
}

The same thing we can see in unix domain sockets, net/unix/diag.c:

if (sk - > sk_state == TCP_LISTEN) {
   rql.udiag_rqueue = sk - > sk_receive_queue.qlen;
   rql.udiag_wqueue = sk - > sk_max_ack_backlog;
} else {
   rql.udiag_rqueue = (u32) unix_inq_len(sk);
   rql.udiag_wqueue = (u32) unix_outq_len(sk);
}

Going deeper into mans gives us folowing in sock_diag(7):

      UDIAG_SHOW_RQLEN
      The attribute reported in answer to this request is
      UNIX_DIAG_RQLEN.The payload associated with this
      attribute is represented in the following structure:

         struct unix_diag_rqlen {
            __u32 udiag_rqueue;
            __u32 udiag_wqueue;
         };

      The fields of this structure are as follows:

         udiag_rqueue
      For listening sockets: the number of pending
      connections.The length of the array associated
      with the UNIX_DIAG_ICONS response attribute is
      equal to this value.

      For established sockets: the amount of data in
         incoming queue.

      udiag_wqueue
      For listening sockets: the backlog length which
      equals to the value passed as the second argu‐
      ment to listen(2).

      For established sockets: the amount of memory
      available
      for sending.

Suggestion : 3

The default listener backlog values are shown in Table 1.,If the backlog reaches the values shown in Table 1, the TCP/IP connection is rejected and the channel is not able to start.,In TCP, connections are treated incomplete unless three-way handshake takes place between the server and the client. These connections are called outstanding connection requests. A maximum value is set for these outstanding connection requests and can be considered a backlog of requests waiting on the TCP port for the listener to accept the request. ,For MCA channels, this results in the channel going into a RETRY state and trying the connection again at a later time.

TCP:
   ListenerBacklog = n

Suggestion : 4

An incomplete connection queue, which contains an entry for each SYN that has arrived from a client for which the server is awaiting completion of the TCP three-way handshake. These sockets are in the SYN_RCVD state (Figure 2.4)., An incomplete connection queue, which contains an entry for each SYN that has arrived from a client for which the server is awaiting completion of the TCP three-way handshake. These sockets are in the SYN_RCVD state (Figure 2.4). ,A completed connection queue, which contains an entry for each client with whom the TCP three-way handshake has completed. These sockets are in the ESTABLISHED state (Figure 2.4)., A completed connection queue, which contains an entry for each client with whom the TCP three-way handshake has completed. These sockets are in the ESTABLISHED state (Figure 2.4).

lib/wrapsock.c

137 void
138 Listen(int fd, int backlog)
139 {
   140 char * ptr;

   141 /* can override 2nd argument with environment variable */
   142
   if ((ptr = getenv("LISTENQ")) != NULL)
      143 backlog = atoi(ptr);

   144
   if (listen(fd, backlog) < 0)
      145 err_sys("listen error");
   146
}