What triggers "No Buffer Space Available"?

[Robert Watson]

On Wed, 2 May 2007, Marc G. Fournier wrote:

> # netstat | egrep "tcp4|udp4" | awk '{print $1}' | uniq -c
> 171 tcp4
> 103 udp4
>
> or is there a better command I should be using?

I generally recommend using a combination of netstat and sockstat.  Sockets 
represent, loosely, IPC endpoints.  There are actually two "layers" associated 
with each socket -- the IPC object (socket) and the protocol control block 
(PCB).  Both are resource limited to pevent run-away processes from swamping 
the system, so exhaustion of either can lead to ENOBUFS.

The behaviors of netstat and sockstat are quite different, even though the 
output is similar: netstat walks the protocol-layer connection lists and 
prints information about them.  sockstat walks the process file descriptor 
table and prints information on reachable sockets.  As sockets can exist 
without PCBs, and PCBs can exist without sockets, you need to look at both to 
get a full picture.  This can occur if a proces exits, closes the socket, and 
the connection remains in, for example, the TIME_WAIT state.

There are some other differences -- the same socket can appear more than once 
in sockstat output, as more than one process can reference the same socket. 
Sockets can also exist without any referencing process (if the application 
closes, but there is still data draining on an open socket).

I would suggest starting with sockstat, as that will allow you to link socket 
use to applications, and provide a fairly neat summary.  When using netstat, 
use "netstat -na", which will list all sockets and avoid name lookups.

Robert N M Watson
Computer Laboratory
University of Cambridge