What are u_str, Recv-Q and Send-Q in ss output?

The ss command is very similar to netstat command but it is faster and more accurate than netstat.

monitoring-server@monitoring-server:~$ ss
Netid State Recv-Q Send- Local Address:Port Peer Address:Port
u_str ESTAB 0 0 * 34006 * 34007 

This is the first line of the ouptut. This command tells all the sockets open in the system.

Total on my system is 96 and 56 of them has u_str as Netidand rest have tcp.

What is this u_str here , Also please explain more about Recv-Q and Send-Q?

2 Answers

u_str is a stream socket and equivalent to netstat's SOCK_STREAM.

SOCK_STREAM: This is a stream (connection) socket.

From Wikipedia:

In computer operating systems, a stream socket is a type of interprocess communications socket or network socket which provides a connection-oriented, sequenced, and unique flow of data without record boundaries, with well-defined mechanisms for creating and destroying connections and for detecting errors.

Let's create a stream socket:

netcat -lU /tmp/streamsocket

Now run:

ss -an | grep streamsocket

It will output:

u_str LISTEN 0 5 /tmp/streamsocket 123360 * 0 

Simply put, it's the type of socket which can be "UDP" or "TCP" too. Let's create a UDP socket:

netcat -lu 127.0.0.1 8060

Now, ss -l sport = 8060 will tell you that this one is a "UDP" instead of "u_str".

For the "Recv-Q" and "Send-Q" columns, consult man 8 netstat:

Recv-Q The count of bytes not copied by the user program connected to this socket.

Send-Q The count of bytes not acknowledged by the remote host.

ss dumps socket statistics. Netid u_str is abbreviation for unix_stream i.e., AF_UNIX socket family and SOCK_STREAM socket type:

The AF_UNIX (also known as AF_LOCAL) socket family is used to communicate between processes on the same machine efficiently. Traditionally, UNIX domain sockets can be either unnamed, or bound to a filesystem pathname (marked as being of type socket). Linux also supports an abstract namespace which is independent of the filesystem.

SOCK_STREAM Provides sequenced, reliable, two-way, connection- based byte streams. An out-of-band data transmission mechanism may be supported.

From the quick intro to ss (/usr/share/doc/iproute2-doc/ss.html):

Then two columns (Recv-Q and Send-Q) showing amount of data queued for receive and transmit.

For unix sockets, it is unix_diag_rqlen from unix_diag.h.