banshee/linux-collection/linux/ssh/tcp

TCP connections of a Linux, by SSH

Returns the established connections, those waiting to be closed on either side (TIME-WAIT, CLOSE-WAIT), the listening ports and the total, IPv4 and IPv6 together.

Versions

Generic: /proc/net/tcp and /proc/net/tcp6 are written by the kernel the same way on Alpine, Debian and Fedora; the awk program only uses what BusyBox awk, mawk (Debian) and gawk (Fedora) all know.

How it works

The collector runs cat /proc/net/tcp /proc/net/tcp6 2>/dev/null | awk '…': awk counts the sockets per state on the target, so that a server with a hundred thousand connections returns a few lines.

tcp6 is missing on a machine without IPv6: cat keeps quiet, and the IPv4 sockets are counted.
The collector's own SSH connection is a TCP connection: reading none stops the collector misconfigured.
Nothing is written on the target.

Prerequisites

an SSH account for monitoring, without write rights;
the fingerprint of the server's host key, set in protocol:ssh:fingerprint (not needed when the Security settings trust the first SSH fingerprint presented).

Outputs

Name	Label	Unit	Per instance
`established`	Established connections	—	no
`time-wait`	Connections in TIME-WAIT	—	no
`close-wait`	Connections in CLOSE-WAIT	—	no
`listen`	Listening ports	—	no
`total`	TCP connections	—	no

Watches

Name	Title	Kind	Defaults	Checked by default
`too-many`	Too many TCP connections	above a threshold, on `established`	no threshold	no
`unusual`	Unusual number of connections	habit, on `established`	sensitivity normal	no
`close-wait`	Connections left open	above a threshold, on `close-wait`	warning above 100, for 3 runs; no critical	no

Limits

Only the network namespace of the SSH server is seen: the connections of a container in its own namespace are not.
CLOSE-WAIT piling up says an application does not close its connections; the collector does not say which one.