In ss -s, what is the kernel counter actually counting?

Question

While troubleshooting a problem on an OEL 7 server (3.10.0-1062.9.1.el7.x86_64), I ran the command

sudo ss -s

Which gave me the output of:

Total: 601 (kernel 1071)
TCP:   8 (estab 2, closed 0, orphaned 0, synrecv 0, timewait 0/0), ports 0

Transport Total     IP        IPv6
        1071     -         -
RAW        2         0         2
UDP        6         4         2
TCP        8         5         3
INET       16        9         7
FRAG       0         0         0

Doing an ss -a | wc -l came back with 225 entries.

It leads me to the question, what is kernel 1071 actually counting? Looking through the various man pages did not provide an answer. Using strace, I can see where ss reads:

/proc/net/sockstat
/proc/net/sockstat6
/proc/net/snmp
/proc/slabinfo

Looking through those files and the docs, it looks like the value is coming from /proc/slabinfo.
Grepping through /proc/slabinfo for 1071 came back with one entry:

sock_inode_cache    1071   1071    640   51    8 : tunables    0    0    0 : slabdata     21     21      0

Looking through the files and docs on sock_inode_cache has not helped so far. I am hoping someone here knows what the kernel counter is actually counting, or can point me in the right direction.

Answer 1

what is kernel 1071 actually counting?

sock_inode_cache represents Linux kernel Slab statistics. It shows how many socket inodes (active objects) are there.

struct socket_alloc corresponds to the sock_inode_cache slab cache and contains the struct socket and struct inode, so it is connected to VFS.