11

There is a long list of stats in /proc/net/netstat and /proc/net/snmp, both of which I think come from the net-tools project. Is there any official or unofficial documentation about these fields? Or even a good source of networking terminology that would help identify them?

Some seem pretty clear:

SyncookiesSent
SyncookieFailed
TCPTimeouts
TCPKeepalive

Others less clear:

ActiveOpens
PassiveOpens

Some fully cryptic to me:

EmbryonicRsts
RcvPruned 
... many more ...

Update: I've found definitions in the source but still wondering where these descriptions go. Are they compiled and published anywhere?

Improve this question

2 Answers 2

Reset to default
18

The /proc/net/* files are generated by the kernel: the entries are in net/ipv4/proc.c in the kernel source, and the entry list is found in include/uapi/linux/snmp.h. It grabs the values from various MIB databases that the kernel keeps.

According to the snmp.h header file, the MIB definitions come from the following documents:

ActiveOpens is from RFC 1213 (page 47):

tcpActiveOpens OBJECT-TYPE
          SYNTAX  Counter
          ACCESS  read-only
          STATUS  mandatory
          DESCRIPTION
                  "The number of times TCP connections have made a
                  direct transition to the SYN-SENT state from the
                  CLOSED state."
          ::= { tcp 5 }

If you can't find the netstat entry in the RFCs, you'll have to search around. Quite a few of the items are not listed in detail in these documents. If you want more than the brief summary, you'll have to search the kernel source for some of the entries that you described.

EmbryonicRsts is modified in net/ipv4/tcp_minisocks.c, at line 796 in Linux 4.16 at least, and appears to count invalid SYN resets on non-fast opened connections. This is probably not likely to occur unless you're in a SYN cookie flood.

Improve this answer
2
  • 1
    I only regret that I have but one upvote to give ;) So then the definitions in the net-tools source I linked must be duplicate and while they may be accurate are not "canonical"? Commented Apr 5, 2018 at 13:00
  • Outside of the LKML, that may be the next best thing to canonical. My feeling is that a lot of the people who contribute to the tools side also contribute to the kernel side, so they likely have a pretty good idea about what the different items actually do! Commented Apr 5, 2018 at 13:46
4

netstat -s has comments for each line

Improve this answer
1
  • Is there a flag to read the value of ListenOverflows? Commented Apr 30, 2020 at 9:23

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.