In this article, FreeNode #freebsd users Tykling & backflow analyze a queue overflow error message from a log of their jailhost. These users came up with a method to track these kinds of problems down should they occur again. Special thanks to the FreeBSD IRC channel for the constant help they provide to the FreeBSD community.

I have no idea what could be causing this. This jailhost is busy so it could be a lot of things. Seems to happen about every hour, perhaps some scheduled job?

Most results when you search for the error mention TCP services that can’t keep up with the connection rate to the TCP port. But since I didn’t know which TCP port I had some detective work to do.

The error from messages looked like this:

Oct  1 01:17:10 bong kernel: sonewconn: pcb 0xfffff800647962d0: Listen queue overflow: 151 already in queue awaiting acceptance (1 occurrences)
Oct  1 02:14:10 bong kernel: sonewconn: pcb 0xfffff800647962d0: Listen queue overflow: 151 already in queue awaiting acceptance (1 occurrences)
Oct  1 03:14:11 bong kernel: sonewconn: pcb 0xfffff800647962d0: Listen queue overflow: 151 already in queue awaiting acceptance (1 occurrences)
Oct  1 04:13:11 bong kernel: sonewconn: pcb 0xfffff800647962d0: Listen queue overflow: 151 already in queue awaiting acceptance (1 occurrences)
Oct  1 05:11:11 bong kernel: sonewconn: pcb 0xfffff800647962d0: Listen queue overflow: 151 already in queue awaiting acceptance (1 occurrences)

Finding the socket from the pcb id

The errors all have the same pcb 0xfffff800647962d0 so I need to find the matching socket. I can use netstat(1) for this: …

Read the full article: https://blog.tyk.nu/blog/fun-with-freebsd-listen-queue-overflow/

Thank you to Matt Olander for submitting the article. If you’d like to submit one, feel free to respond in the comments.