sock_diag(7)

💖 sock_diag 💖 — it's the sock_diag(7) manual, Miscellaneous Information Manual energy

okay bestie, sit DOWN because today we're learning how to ask the kernel "hey girl, what sockets do you have open?" 🫶 This is sock_diag, and it's giving detective vibes, it's giving nosy bestie, it's giving tell me everything.

---

✨ NAME ✨

sock_diag — obtaining information about sockets 💅

---

✨ SYNOPSIS ✨

#include <sys/socket.h>
#include <linux/sock_diag.h>
#include <linux/unix_diag.h> /* for UNIX domain sockets */
#include <linux/inet_diag.h> /* for IPv4 and IPv6 sockets */

diag_socket = socket(AF_NETLINK, socket_type, NETLINK_SOCK_DIAG);

---

✨ DESCRIPTION ✨

So the sock_diag netlink subsystem? It's literally the hookup for getting info about sockets from the kernel — and not just one address family, like, various ones ✨. You can use it to snoop on one single socket, or you can ask for a whole list of sockets. Both. She does both. 👑

When you send a request, you get to say extra stuff you wanna know about the socket — like memory info, or address-family-specific tea 🍵.

And when you're requesting a whole list of sockets? You can hand the kernel filters and it will apply them, picking out just a subset of sockets to report back. For now, the only filtering ability is by state (connected, listening, and so on). That's it. That's the filter. Don't get greedy 💀.

Important lil note: sock_diag only reports sockets that have a name — meaning either sockets bound explicitly with bind(2), or sockets that got automatically bound to an address (e.g., by connect(2)). It's the exact same set of sockets you'd see via /proc/net/unix, /proc/net/tcp, /proc/net/udp, and so on. Same crew, different door 🚪

🌸 Request 🌸

The request kicks off with a struct nlmsghdr header (described over in netlink(7)) where the nlmsg_type field is set to SOCK_DIAG_BY_FAMILY. Then right after that comes an address-family-specific header, which starts with a common part that literally every address family shares:

struct sock_diag_req {
    __u8 sdiag_family;
    __u8 sdiag_protocol;
};

The fields of this structure are as follows, bestie:

• sdiag_family — an address family. Set it to the appropriate AF_* constant.
• sdiag_protocol — depends on sdiag_family. Set it to the appropriate IPPROTO_* constant for AF_INET and AF_INET6, and to 0 otherwise.

If the nlmsg_flags field of the struct nlmsghdr header has the NLM_F_DUMP flag set, that means you're requesting a list of sockets ✨. Otherwise? It's a query about one single individual socket. Just the one. Main character socket 💅

🌸 Response 🌸

The response starts with a struct nlmsghdr header, and then it's followed by an array of objects specific to the address family. You access that array with the standard NLMSG_* macros from the netlink(3) API.

Each object is the NLA (netlink attributes) list, and you access that with the RTA_* macros from the rtnetlink(3) API. Nested cuteness. Layers on layers 🧚

🌸 UNIX domain sockets 🌸

For UNIX domain sockets, the request is represented in this structure:

struct unix_diag_req {
    __u8    sdiag_family;
    __u8    sdiag_protocol;
    __u16   pad;
    __u32   udiag_states;
    __u32   udiag_ino;
    __u32   udiag_show;
    __u32   udiag_cookie[2];
};

The fields of this structure are as follows:

• sdiag_family — the address family; set it to AF_UNIX.
• sdiag_protocol
• pad — these fields should be set to 0.
• udiag_states — this is a bit mask that defines a filter of socket states. Only the sockets whose states are in this mask get reported. It's ignored when you're querying for an individual socket. The supported values are:
  • 1 << TCP_ESTABLISHED
  • 1 << TCP_LISTEN
• udiag_ino — this is an inode number, used when querying for an individual socket. It's ignored when querying for a list of sockets.
• udiag_show — this is a set of flags defining what kind of information to report. Each requested kind of info gets reported back as a netlink attribute, like this:
  • UDIAG_SHOW_NAME — the attribute reported in answer to this request is UNIX_DIAG_NAME. The payload associated with this attribute is the pathname to which the socket was bound (a sequence of bytes up to UNIX_PATH_MAX size).
  • UDIAG_SHOW_VFS — the attribute reported in answer to this request is UNIX_DIAG_VFS. The payload associated with this attribute is represented in the following structure:

struct unix_diag_vfs {
    __u32 udiag_vfs_dev;
    __u32 udiag_vfs_ino;
};

The fields of this structure are as follows:

• udiag_vfs_dev — the device number of the corresponding on-disk socket inode.
• udiag_vfs_ino — the inode number of the corresponding on-disk socket inode.

• UDIAG_SHOW_PEER — the attribute reported in answer to this request is UNIX_DIAG_PEER. The payload associated with this attribute is a __u32 value, which is the peer's inode number. This attribute is reported for connected sockets only.
• UDIAG_SHOW_ICONS — the attribute reported in answer to this request is UNIX_DIAG_ICONS. The payload associated with this attribute is an array of __u32 values, which are inode numbers of sockets that have passed the connect(2) call but haven't been processed with accept(2) yet. This attribute is reported for listening sockets only. (Yes it's called ICONS. No we don't know why. Slay.)
• UDIAG_SHOW_RQLEN — the attribute reported in answer to this request is UNIX_DIAG_RQLEN. The payload associated with this attribute is represented in the following structure:

struct unix_diag_rqlen {
    __u32 udiag_rqueue;
    __u32 udiag_wqueue;
};

The fields of this structure are as follows:

• udiag_rqueue — for listening sockets: the number of pending connections. The size of the array associated with the UNIX_DIAG_ICONS response attribute is equal to this value.

For established sockets: the amount of data in the incoming queue.

• udiag_wqueue — for listening sockets: the backlog size, which equals the value passed as the second argument to listen(2).

For established sockets: the amount of memory available for sending.

• UDIAG_SHOW_MEMINFO — the attribute reported in answer to this request is UNIX_DIAG_MEMINFO. The payload associated with this attribute is an array of __u32 values, described below in the subsection "Socket memory information".

The following attribute is reported back without any specific request:

• UNIX_DIAG_SHUTDOWN — the payload associated with this attribute is a __u8 value which represents bits of shutdown(2) state.

• udiag_cookie — this is an array of opaque identifiers that could be used along with udiag_ino to specify an individual socket. It's ignored when querying for a list of sockets, and also when all its elements are set to -1.

The response to a query for UNIX domain sockets is represented as an array of

struct unix_diag_msg {
    __u8    udiag_family;
    __u8    udiag_type;
    __u8    udiag_state;
    __u8    pad;
    __u32   udiag_ino;
    __u32   udiag_cookie[2];
};

followed by netlink attributes.

The fields of this structure are as follows:

• udiag_family — this field has the same meaning as in struct unix_diag_req.
• udiag_type — this is set to one of SOCK_PACKET, SOCK_STREAM, or SOCK_SEQPACKET.
• udiag_state — this is set to one of TCP_LISTEN or TCP_ESTABLISHED.
• pad — this field is set to 0.
• udiag_ino — this is the socket inode number.
• udiag_cookie — this is an array of opaque identifiers that could be used in subsequent queries.

🌸 IPv4 and IPv6 sockets 🌸

For IPv4 and IPv6 sockets, the request is represented in the following structure:

struct inet_diag_req_v2 {
    __u8    sdiag_family;
    __u8    sdiag_protocol;
    __u8    idiag_ext;
    __u8    pad;
    __u32   idiag_states;
    struct inet_diag_sockid id;
};

where struct inet_diag_sockid is defined as follows:

struct inet_diag_sockid {
    __be16  idiag_sport;
    __be16  idiag_dport;
    __be32  idiag_src[4];
    __be32  idiag_dst[4];
    __u32   idiag_if;
    __u32   idiag_cookie[2];
};

The fields of struct inet_diag_req_v2 are as follows:

• sdiag_family — this should be set to either AF_INET or AF_INET6, for IPv4 or IPv6 sockets respectively.
• sdiag_protocol — this should be set to one of IPPROTO_TCP, IPPROTO_UDP, or IPPROTO_UDPLITE.
• idiag_ext — this is a set of flags defining what kind of extended information to report. Each requested kind of info gets reported back as a netlink attribute, like this:
  • INET_DIAG_TOS — the payload associated with this attribute is a __u8 value, which is the TOS of the socket.
  • INET_DIAG_TCLASS — the payload associated with this attribute is a __u8 value, which is the TClass of the socket. IPv6 sockets only. For LISTEN and CLOSE sockets, this is followed by the INET_DIAG_SKV6ONLY attribute with an associated __u8 payload value meaning whether the socket is IPv6-only or not.
  • INET_DIAG_MEMINFO — the payload associated with this attribute is represented in the following structure:

struct inet_diag_meminfo {
    __u32 idiag_rmem;
    __u32 idiag_wmem;
    __u32 idiag_fmem;
    __u32 idiag_tmem;
};

The fields of this structure are as follows:

• idiag_rmem — the amount of data in the receive queue.
• idiag_wmem — the amount of data that is queued by TCP but not yet sent.
• idiag_fmem — the amount of memory scheduled for future use (TCP only).

• idiag_tmem — the amount of data chillin' in the send queue 💌
• INET_DIAG_SKMEMINFO — the payload that rides along with this attribute is an array of __u32 values, and bestie, every single one of them is spelled out down below in the "Socket memory information" subsection 👀
• INET_DIAG_INFO — the payload that rides along with this attribute is specific to the address family. If we're talking TCP sockets, it's an object of type struct tcp_info.
• INET_DIAG_CONG — the payload that rides along with this attribute is a string describing the congestion control algorithm being used. TCP sockets only, that's the rule 📏
• pad — this should be set to 0. That's it, that's the whole assignment. Set it to 0 ✨
• idiag_states — a bit mask that filters which socket states you get back 🎯 Only the sockets whose states land inside this mask get reported. It's ignored when you're querying a single individual socket.
• id — a socket ID object 🪪 It shows up in dump requests, in queries about individual sockets, and it gets reported back in every single response. And here's the thing: unlike UNIX domain sockets, IPv4 and IPv6 sockets get identified using addresses and ports. All of these values are in network byte order, so don't get caught out 😭

The fields of struct inet_diag_sockid are as follows:

• idiag_sport — the source port.
• idiag_dport — the destination port.
• idiag_src — the source address.
• idiag_dst — the destination address.
• idiag_if — the interface number the socket is bound to.
• idiag_cookie — an array of opaque identifiers 🍪 You can use these together with the other fields of this structure to pin down one specific socket. But they get ignored when you're querying for a whole list of sockets, and also ignored whenever all of their elements are set to -1.

The response to a query for IPv4 or IPv6 sockets is represented as an array of

struct inet_diag_msg {
    __u8    idiag_family;
    __u8    idiag_state;
    __u8    idiag_timer;
    __u8    idiag_retrans;

    struct inet_diag_sockid id;

    __u32   idiag_expires;
    __u32   idiag_rqueue;
    __u32   idiag_wqueue;
    __u32   idiag_uid;
    __u32   idiag_inode;
};

followed by netlink attributes 💫

The fields of this structure are as follows:

• idiag_family — literally the same field as in struct inet_diag_req_v2.
• idiag_state — this is the socket state, same deal as in struct inet_diag_req_v2.
• idiag_timer — for TCP sockets, this field tells you which kind of timer is active on the socket right now. It's set to one of these constants:
  • 0 — no timer is active
  • 1 — a retransmit timer
  • 2 — a keep-alive timer
  • 3 — a TIME_WAIT timer
  • 4 — a zero window probe timer

For non-TCP sockets, this field is set to 0.

• idiag_retrans — for idiag_timer values 1, 2, and 4, this field holds the number of retransmits. For any other idiag_timer value, this field is set to 0.
• idiag_expires — for TCP sockets that have an active timer, this field describes its expiration time in milliseconds. For every other socket, this field is set to 0.
• idiag_rqueue — for listening sockets: the number of pending connections. For other sockets: the amount of data in the incoming queue.
• idiag_wqueue — for listening sockets: the backlog size. For other sockets: the amount of memory available for sending.
• idiag_uid — this is the socket owner UID.
• idiag_inode — this is the socket inode number.

---

🧠 Socket memory information

The payload that comes with the UNIX_DIAG_MEMINFO and INET_DIAG_SKMEMINFO netlink attributes is an array of the following __u32 values:

• SK_MEMINFO_RMEM_ALLOC — the amount of data in the receive queue.
• SK_MEMINFO_RCVBUF — the receive socket buffer as set by SO_RCVBUF.
• SK_MEMINFO_WMEM_ALLOC — the amount of data in the send queue.
• SK_MEMINFO_SNDBUF — the send socket buffer as set by SO_SNDBUF.
• SK_MEMINFO_FWD_ALLOC — the amount of memory scheduled for future use (TCP only).
• SK_MEMINFO_WMEM_QUEUED — the amount of data queued by TCP, but not yet sent.
• SK_MEMINFO_OPTMEM — the amount of memory allocated for the socket's service needs (e.g., socket filter).
• SK_MEMINFO_BACKLOG — the amount of packets in the backlog (not yet processed).

---

✨ VERSIONS ✨

History lesson time, bestie 📚 NETLINK_INET_DIAG was introduced in Linux 2.6.14, and back then it only supported AF_INET and AF_INET6 sockets. Then in Linux 3.3, it got renamed to NETLINK_SOCK_DIAG and extended to support AF_UNIX sockets too. Glow-up behavior honestly 💅

UNIX_DIAG_MEMINFO and INET_DIAG_SKMEMINFO were introduced in Linux 3.6.

---

🎀 STANDARDS 🎀

Linux. That's the whole section. Iconic brevity 👑

---

💅 EXAMPLES 💅

okay so this little program right here prints the inode number, the peer's inode number, and the name of every UNIX domain socket hanging out in the current namespace 🫶

#include <errno.h>
#include <stdio.h>
#include <string.h>
#include <unistd.h>
#include <sys/socket.h>
#include <sys/un.h>
#include <linux/netlink.h>
#include <linux/rtnetlink.h>
#include <linux/sock_diag.h>
#include <linux/unix_diag.h>

static int
send_query(int fd)
{
    struct sockaddr_nl nladdr = {
        .nl_family = AF_NETLINK
    };
    struct
    {
        struct nlmsghdr nlh;
        struct unix_diag_req udr;
    } req = {
        .nlh = {
            .nlmsg_len = sizeof(req),
            .nlmsg_type = SOCK_DIAG_BY_FAMILY,
            .nlmsg_flags = NLM_F_REQUEST | NLM_F_DUMP
        },
        .udr = {
            .sdiag_family = AF_UNIX,
            .udiag_states = -1,
            .udiag_show = UDIAG_SHOW_NAME | UDIAG_SHOW_PEER
        }
    };
    struct iovec iov = {
        .iov_base = &req,
        .iov_len = sizeof(req)
    };
    struct msghdr msg = {
        .msg_name = &nladdr,
        .msg_namelen = sizeof(nladdr),
        .msg_iov = &iov,
        .msg_iovlen = 1
    };

    for (;;) {
        if (sendmsg(fd, &msg, 0) < 0) {
            if (errno == EINTR)
                continue;

            perror("sendmsg");
            return -1;
        }

        return 0;
    }
}

static int
print_diag(const struct unix_diag_msg *diag, unsigned int size)
{
    if (size < NLMSG_LENGTH(sizeof(*diag))) {
        fputs("short response\n", stderr);
        return -1;
    }
    if (diag->udiag_family != AF_UNIX) {
        fprintf(stderr, "unexpected family %u\n", diag->udiag_family);
        return -1;
    }

    unsigned int rta_len = size - NLMSG_LENGTH(sizeof(*diag));
    unsigned int peer = 0;
    size_t path_len = 0;
    char path[sizeof(((struct sockaddr_un *) 0)->sun_path) + 1];

    for (struct rtattr *attr = (struct rtattr *) (diag + 1);
             RTA_OK(attr, rta_len); attr = RTA_NEXT(attr, rta_len)) {
        switch (attr->rta_type) {
        case UNIX_DIAG_NAME:
            if (!path_len) {
                path_len = RTA_PAYLOAD(attr);
                if (path_len > sizeof(path) - 1)
                    path_len = sizeof(path) - 1;
                memcpy(path, RTA_DATA(attr), path_len);
                path[path_len] = '\0';
            }
            break;

        case UNIX_DIAG_PEER:
            if (RTA_PAYLOAD(attr) >= sizeof(peer))
                peer = *(unsigned int *) RTA_DATA(attr);
            break;
        }
    }

    printf("inode=%u", diag->udiag_ino);

    if (peer)
        printf(", peer=%u", peer);

    if (path_len)
        printf(", name=%s%s", *path ? "" : "@",
                *path ? path : path + 1);

    putchar('\n');
    return 0;
}

static int
receive_responses(int fd)
{
    long buf[8192 / sizeof(long)];
    struct sockaddr_nl nladdr;
    struct iovec iov = {
        .iov_base = buf,
        .iov_len = sizeof(buf)
    };
    int flags = 0;

    for (;;) {
        struct msghdr msg = {
            .msg_name = &nladdr,
            .msg_namelen = sizeof(nladdr),
            .msg_iov = &iov,
            .msg_iovlen = 1
        };

        ssize_t ret = recvmsg(fd, &msg, flags);

        if (ret < 0) {
            if (errno == EINTR)
                continue;

            perror("recvmsg");
            return -1;
        }
        if (ret == 0)
            return 0;

        if (nladdr.nl_family != AF_NETLINK) {
            fputs("!AF_NETLINK\n", stderr);
            return -1;
        }

        const struct nlmsghdr *h = (struct nlmsghdr *) buf;

        if (!NLMSG_OK(h, ret)) {
            fputs("!NLMSG_OK\n", stderr);
            return -1;
        }

        for (; NLMSG_OK(h, ret); h = NLMSG_NEXT(h, ret)) {
            if (h->nlmsg_type == NLMSG_DONE)
                return 0;

            if (h->nlmsg_type == NLMSG_ERROR) {
                const struct nlmsgerr *err = NLMSG_DATA(h);

                if (h->nlmsg_len < NLMSG_LENGTH(sizeof(*err))) {
                    fputs("NLMSG_ERROR\n", stderr);
                } else {
                    errno = -err->error;
                    perror("NLMSG_ERROR");
                }

                return -1;
            }

            if (h->nlmsg_type != SOCK_DIAG_BY_FAMILY) {
                fprintf(stderr, "unexpected nlmsg_type %u\n",
                        (unsigned) h->nlmsg_type);
                return -1;
            }

            if (print_diag(NLMSG_DATA(h), h->nlmsg_len))
                return -1;
        }
    }
}

int
main(void)
{
    int fd = socket(AF_NETLINK, SOCK_RAW, NETLINK_SOCK_DIAG);

    if (fd < 0) {
        perror("socket");
        return 1;
    }

    int ret = send_query(fd) || receive_responses(fd);

    close(fd);
    return ret;
}

---

🦋 SEE ALSO 🦋

• netlink(3)
• rtnetlink(3)
• netlink(7)
• tcp(7)

---

and that's the whole page, bestie 🥹 this is Linux man-pages 6.20, dated 2026-02-08 — go forth and diag those sockets, you absolute legend 👑💖