This one is going to be short. Recently I wrote about NGINX socket multiplexing. And there was one question I was curious about which was left unanswered - “How are new connections buffered”. What happens at the kernel level? I did some digging. So let’s start…

TCP Sockets

Unix Network Programming Fig 4.1

Unix Network Programming Fig 4.1

# A simple TCP server in python that reads headers and data
import socket
import json

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

s.bind(('', 7777))

print("Listening for connections...")

while True:
    conn, addr = s.accept()
    print(f"New connection at {addr}")
    req = conn.recv(4096)
    headers, body = req.split(b'\r\n\r\n')

    data = {}
    for header in headers.split(b'\r\n')[1:]:
        k, v = header.split(b': ')
        data[k.decode('utf-8')] = v.decode('utf-8')
    conn.send(b'HTTP/1.1 200 OK\r\n\r\n')
    conn.send(json.dumps(data, indent=4).encode('utf-8'))

What happens when there are more clients coming at once

We need to take a closer look at listen and accept calls to understand what’s going on here.


man listen

man listen

Well there you go, the kernel does maintain a queue and its limit can be set with the backlog parameter.

Connection Queues

The kernel maintains 2 queues:

  1. An incomplete connection queue, which contains an entry for each SYN that has arrived from a client for which the server is awaiting completion of the TCP three-way handshake. These sockets are in the SYN_RCVD state
  2. completed connection queue, which contains an entry for each client with whom the TCP three-way handshake has been completed. These sockets are in the ESTABLISHED state
Unix Network Programming Fig 4.7

Unix Network Programming Fig 4.7

Unix Network Programming Fig 4.8

Unix Network Programming Fig 4.8


backlog argument

SYN Flooding

A famous attack is the SYN flood where the idea is to fill the incomplete queue with bogus SYNs so that legitimate SYNs are not queued providing a denial of service to the legitimate clients

Closing Notes

Life is queues all the way down. A store is a queue with one side closed. Things flow from one end to another and stored in a place for a while. Money flows, Information flows, Matter flows, Time flows, and so do we…