While running netstat -s on Linux, I got below statistics for IP protocol (information for other protocols are omitted),

    322937 total packets received
    0 forwarded
    0 incoming packets discarded
    322932 incoming packets delivered
    213695 requests sent out
    14 outgoing packets dropped

Regarding below two statistics,

"322932 incoming packets delivered"
"213695 requests sent out"

Does the first mean 322932 incoming packets delivered to the application layer? Does the second one mean that there are 213695 requests initiated from this server have been sent out?

Your help is appreciated!

1 Answer 1


It's not easy to find a document talking about the exact meanings of the statistics in the output of netstat -s. One way to find them is to look at the source code of netstat.c, specifically the statistics part of it where, for "incoming packets delivered", we see

{"InDelivers", N_("%llu incoming packets delivered"), number},

Then you look up InDelivers in the protocol where we see

The total number of input datagrams successfully delivered to IP user-protocols (including ICMP).

as the description of ipInDelivers.

The question comes down to What is "IP user-protocols"? In RFC986 we see

"The Current IP addresses and IP user protocol numbers can be found in [4].

where Reference [4] points to RFC960, and in there we can confirm that the so-called "IP user-protocols" are indeed upper layer, i.e. transport layer, protocols, such as TCP, UDP, ICMP, etc.

You shouldn't say "application layer" because that term specifically refers to the highest layer (layer 7) in the OSI network model.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .