Check network-connections


Counts tcp (v4), tcp6 (v6), udp (v4) and udp6 (v6) connection details. Output is grouped by connection type and status, ordered by the number of connections (descending). Emulating ss -s and ss -antp.

Meaning of connection type --conn-type parameter:

  • tcp: TCP over IPv4

  • tcp6: TCP over IPv6

  • udp4: UDP over IPv4

  • udp6: UDP over IPv6

Meaning of connection status --conn-status parameter:

  • CLOSE: Closed. The socket is not being used.

  • CLOSE_WAIT: Remote shutdown; waiting for the socket to close - means the other end of the connection has been closed while the local end is still waiting for the application to close.

  • CLOSING: Closed, then remote shutdown; awaiting acknowledgment.

  • ESTABLISHED: Connection has been established.

  • FIN_WAIT_1: Socket closed; shutting down connection.

  • FIN_WAIT_2: Socket closed; waiting for shutdown from remote.

  • IDLE: Idle, opened but not bound.

  • LAST_ACK: Remote shutdown, then closed; awaiting acknowledgment.

  • LISTEN: Listening for incoming connections.

  • NONE: For UDP sockets this is always going to be „None“.

  • SYN_RECV: Active/initiate synchronization received and the connection under way.

  • SYN_SENT: Actively trying to establish connection.

  • TIME_WAIT: Wait after close for remote shutdown retransmission.

This check optionally alerts if the number of any connection type and status does not fit into the given ranges.

Fact Sheet

Check Plugin Download

Check Interval Recommendation

Once a minute

Can be called without parameters


Available for

Python 2, Python 3, Windows


Python module psutil


usage: network-connections [-h] [-V]
                           [--conn-status {all,close,close_wait,closing,established,fin_wait1,fin_wait2,last_ack,listen,none,syn_recv,syn_sent,time_wait}]
                           [--conn-type {all,tcp,tcp6,udp,udp6}]
                           [-c CRIT] [-w WARN]

Counts system-wide socket connections like tcp, tcp6, udp or udp6. If you have
too many connections like TCP_CLOSE and therefore get errors like "too many
files open", reconfigure and/or restart the application that is receiving or
processing those connections.

  -h, --help            show this help message and exit
  -V, --version         show program's version number and exit
  --conn-status {all,close,close_wait,closing,established,fin_wait1,fin_wait2,last_ack,listen,none,syn_recv,syn_sent,time_wait}
                        Filter the status of the connections (repeating).
                        Default: None
  --conn-type {all,tcp,tcp6,udp,udp6,unix}
                        Filter the family/type of the connections (repeating).
                        Default: None
  -c CRIT, --critical CRIT
                        Threshold for the number of connections. Type: None or
                        Range. Default: None
  -w WARN, --warning WARN
                        Threshold for the number of connections. Type: None or
                        Range. Default: None

Usage Examples

Just get network statistics and don’t alert on anything:



tcp ESTABLISHED: 19, udp NONE: 16, tcp LISTEN: 9, udp6 NONE: 5, tcp CLOSE WAIT: 4, tcp6 LISTEN: 4, tcp TIME WAIT: 1, tcp6 CLOSE WAIT: 1

Alert if number of established TCP (v4) connections is higher than 200:

./network-connections --conn-type=tcp --conn-status=established --warning=200



Alert if number of any established connection is not between 30 and 40:

./network-connections --conn-type=all --conn-status=established --warning=30:40



Use repeating parameter:

./network-connections --conn-type=tcp6 --conn-status=established --conn-status=closing --warning=30:40


No connections of type "tcp6" in status "established,closing" found.


  • WARN or CRIT if number of connections found does not fit into the given ranges.

Perfdata / Metrics

Depends on your connections. As an example:

  • tcp_CLOSE_WAIT


  • tcp_LISTEN

  • tcp_TIME_WAIT


  • tcp6_LISTEN

  • udp_NONE

  • udp6_NONE

Credits, License