Given a linux TCP socket's inode (obtained via /proc/<pid>/fd), is there a faster way to look up the information that I can get from /proc/net/tcp about this socket?
I have written a troubleshooting tool which monitors processes and prints realtime information about IO operations (strace-type info collected into higher level abstractions and presented in a less raw way), but on a heavily loaded network server, I am finding that the time it takes to look up socket info (e.g. the foreign address/port) is prohibitive simply due to the very large size of /proc/net/tcp (about 2MB on the server I'm currently looking at).
I can manage this somewhat with caching, but this necessarily introduces latency and makes me wonder about the absurdity of an "API" that requires reading and parsing 2MB worth of ASCII text in order to find info on a socket.
Best Answer
Here is a link to libnetfilter_conntrack. You would have to re-write your program in a language that can support calling C functions from a library directly. But I think this library will have the hooks you need to get the data you want much faster than parsing through that text file.
This is what the
iptstateprogram uses to accomplish its task.