Linux
banshee/linux-collection/linux/snmp/
tcp
Number of established TCP connections of a Linux host by SNMP.
by banshee1 installation2 versions
v2Latest
Published on October 28, 2026. One naming convention across collections; documentation completed.
TCP connections of a Linux host, by SNMP
Returns the number of established TCP connections. Two watches are offered, with no default threshold.
Versions
Generic: tcpCurrEstab (TCP-MIB) is served the same way by net-snmp on any Linux.
How it works
The collector reads tcpCurrEstab (TCP-MIB): the connections in the ESTABLISHED or CLOSE-WAIT state, at the moment of the run.
Prerequisites
snmpd(net-snmp) running on the host, listening on an address the poller reaches (UDP 161), with the firewall open to the poller only.- The view granted to the poller includes the
tcpgroup (.1.3.6.1.2.1.6). - Read-only access, SNMPv2c or SNMPv3, set on the host or one of its folders (
protocol:snmp:*variables).
# /etc/snmp/snmpd.conf
agentaddress udp:161
view banshee included .1.3.6.1.2.1.6.9
rocommunity <community> 192.0.2.10 -V banshee
# or: rouser <user> priv -V bansheeOutputs
| Name | Label | Unit | Per instance |
|---|---|---|---|
established | Established connections | — | no |
Watches
| Name | Title | Kind | Defaults | Checked by default |
|---|---|---|---|---|
too-many | Too many TCP connections | above a threshold, on established | no threshold | no |
unusual | Unusual number of connections | habit, on established | sensitivity normal | no |
Limits
- What is normal depends on the server's role: neither watch has a default threshold.
- Connections in other states (
TIME-WAIT,SYN-RECV) are not counted: a flood of half-open connections is not seen.