ss命令查看socket上包的占用内存

统计socket接收发送队列上的数据长度

一般情况下使用只会显示接收发送队列的包数

# ./ss -ntp
State      Recv-Q Send-Q  Local Address:Port    Peer Address:Port Process                             
ESTAB      0      0      192.168.66.252:54130 14.116.220.228:443   users:(("tycfs",pid=10271,fd=8))   
ESTAB      0      572    192.168.66.252:35838   113.249.86.3:443   users:(("tycfs",pid=10271,fd=15))  
ESTAB      0      572    192.168.66.252:35832   113.249.86.3:443   users:(("tycfs",pid=10271,fd=21))  
CLOSE-WAIT 25     0      192.168.66.252:55502  14.18.110.142:443   users:(("tycfs",pid=10282,fd=14))  
ESTAB      0      0      192.168.66.252:56252  14.18.110.142:443   users:(("tycfs",pid=10271,fd=25))  
ESTAB      0      77        192.168.6.1:445      192.168.6.2:49213 users:(("smbd",pid=10839,fd=47))   
ESTAB      82690  0      192.168.66.252:35804   113.249.86.3:443   users:(("tycfs",pid=10271,fd=24))  
CLOSE-WAIT 25     0      192.168.66.252:55542  14.18.110.142:443   users:(("tycfs",pid=10282,fd=15))  

统计内存信息需要-m参数，但可能开了-m参数还是没有，这时需要打开内核宏

内核打开宏：

CONFIG_INET_DIAG=y
CONFIG_INET_TCP_DIAG=y
CONFIG_INET_UDP_DIAG

这时输出如下：

# ./ss -ntpm
State      Recv-Q Send-Q  Local Address:Port    Peer Address:Port Process                                                                                           
ESTAB      0      570    192.168.66.252:35980   113.249.86.3:443   users:(("tycfs",pid=10271,fd=14))
         skmem:(r0,rb1492008,t0,tb48640,f194176,w2432,o0,bl0,d0)      
ESTAB      0      570    192.168.66.252:35998   113.249.86.3:443   users:(("tycfs",pid=10271,fd=16))
         skmem:(r0,rb1737680,t0,tb48640,f140928,w2432,o0,bl0,d0)      
ESTAB      0      0      192.168.66.252:54130 14.116.220.228:443   users:(("tycfs",pid=10271,fd=8))
         skmem:(r0,rb1946944,t0,tb48640,f0,w0,o0,bl0,d1)               
ESTAB      65652  0      192.168.66.252:35996   113.249.86.3:443   users:(("tycfs",pid=10271,fd=13))
         skmem:(r111360,rb1408120,t0,tb48640,f32000,w0,o0,bl0,d0)     

主要看r，t这两个就够了，r表示接收的包，t表示发送的包。

fwd_alloc（接收缓存），wmem_queued（发送缓存）。这两个字段没有实际意义，查了下资料，它只表明一个额度，一个水线。并不真正会占用内存。

统计总共占用内存

接收缓冲占用总内存（单位KB）

./ss -napm | awk -F '[\(|,]' '/skmem/ {print $2}' | cut -c 2- | awk '{a+=$1}END{print a/1024}'

发送缓冲占用总内存（单位KB）

/ss -napm | awk -F '[\(|,]' '/skmem/ {print $4}' | cut -c 2- | awk '{a+=$1}END{print a/1024}'

其他内存信息含义

-m, --memory
              Show socket memory usage. The output format is:

              skmem:(r<rmem_alloc>,rb<rcv_buf>,t<wmem_alloc>,tb<snd_buf>,
                            f<fwd_alloc>,w<wmem_queued>,o<opt_mem>,
                            bl<back_log>,d<sock_drop>)
             <rmem_alloc>
                     the memory allocated for receiving packet

              <rcv_buf>
                     the total memory can be allocated for receiving packet

              <wmem_alloc>
                     the memory used for sending packet (which has been sent to layer 3)

              <snd_buf>
                     the total memory can be allocated for sending packet

              <fwd_alloc>
                     the memory allocated by the socket as cache, but not used for receiving/sending packet yet. If need memory to send/receive packet, the mem‐
                     ory in this cache will be used before allocate additional memory.

              <wmem_queued>
                     The memory allocated for sending packet (which has not been sent to layer 3)

              <ropt_mem>
                     The memory used for storing socket option, e.g., the key for TCP MD5 signature

              <back_log>
                     The memory used for the sk backlog queue. On a process context, if the process is receiving packet, and a new packet is received,  it  will
                     be put into the sk backlog queue, so it can be received by the process immediately

              <sock_drop>
                     the number of packets dropped before they are de-multiplexed into the socket