banshee/linux-collection/linux/ssh/tcp

TCP connections of a Linux, by SSH

Returns the established connections, those waiting to be closed on either side (TIME-WAIT, CLOSE-WAIT), the listening ports and the total, IPv4 and IPv6 together.

How it works

The collector runs cat /proc/net/tcp /proc/net/tcp6 2>/dev/null | awk '…': awk counts the sockets per state on the target, so that a server with a hundred thousand connections returns a few lines.

tcp6 is missing on a machine without IPv6: cat keeps quiet, and the IPv4 sockets are counted.
The collector's own SSH connection is a TCP connection: reading none stops the collector misconfigured.
Portable: both files are written by the kernel the same way on Alpine, Debian and Fedora; the awk program only uses what BusyBox awk, mawk (Debian) and gawk (Fedora) all know. Nothing is written on the target.

Prerequisites

an SSH account for monitoring, without write rights;
the fingerprint of the server's host key, set in protocol:ssh:fingerprint (not needed when the Security settings trust the first SSH fingerprint presented).

Outputs

Output	Meaning
`established`	connections in ESTABLISHED
`time-wait`	connections in TIME-WAIT
`close-wait`	connections in CLOSE-WAIT
`listen`	listening sockets
`total`	all TCP sockets

Watches

Watch	Kind	Defaults	Checked
`too-many` Too many TCP connections	above, on `established`	no threshold	no
`unusual` Unusual number of connections	habit, on `established`	sensitivity normal	no
`close-wait` Connections left open	above, on `close-wait`	warning 100, for 3 runs	no

Limits

Only the network namespace of the SSH server is seen: the connections of a container in its own namespace are not.
CLOSE-WAIT piling up says an application does not close its connections; the collector does not say which one.