Resolve the issue that the Send-Q return value is 0 on an Alibaba Cloud Linux 2 instance - Alibaba Cloud Linux

When you run ss -lnt on an Alibaba Cloud Linux 2 Elastic Compute Service (ECS) instance and see Send-Q showing 0 for all listening sockets, this is a known kernel limitation — not a network issue. Upgrading the kernel resolves it.

Symptoms

Running ss -lnt produces output similar to the following, where Send-Q is 0 for all entries:

# ss -lnt
State       Recv-Q Send-Q   Local Address:Port   Peer Address:Port
LISTEN      0      0                    *:35107               *:*
LISTEN      0      0                    *:38727               *:*
LISTEN      0      0                    *:5355                *:*
LISTEN      0      0                    *:111                 *:*

For a listening TCP socket, Send-Q represents the maximum size of the syn backlog — the maximum number of pending connection requests the socket can queue. This value is always non-zero on a healthy system.

Affected versions

This issue affects instances running the following versions:

Component	Affected versions
Image	`aliyun-2.1903-x64-20G-alibase-20190507.vhd` or earlier
Kernel	`4.19.43-13.al7.x86_64` or earlier

To check your current kernel version, run:

uname -r

Cause

The tcp_diag kernel module is not included in kernel 4.19.43-13.al7.x86_64 or earlier. Without tcp_diag, the ss command falls back to reading from /proc/net/tcp (not recommended). In this fallback mode, the tx_queue value for listening TCP sockets is always 0, which causes Send-Q to show 0.

Prerequisites

Before upgrading the kernel:

Back up any critical data on the instance
Review the release notes for Alibaba Cloud Linux 2 to understand compatibility changes in the target kernel version
Schedule the upgrade during off-peak hours to minimize service impact

Warning

Kernel upgrades may introduce compatibility and stability issues. Review the release notes before proceeding. Restarting the instance stops it temporarily and may interrupt running services, resulting in data loss. Back up critical data before restarting.

Solution

Step 1: Confirm the tcp_diag module is missing

sudo lsmod | grep tcp_diag

Interpret the output as follows:

No output: The tcp_diag module is not loaded. This confirms the root cause — continue to step 2.
Output shown: The module is loaded. The Send-Q value of 0 has a different cause. Investigate further before proceeding.

Step 2: Upgrade the kernel

sudo yum update kernel

Step 3: Restart the instance

sudo reboot

After the instance restarts with the new kernel, the tcp_diag module is included and ss -lnt returns accurate Send-Q values.