1

There is a long list of stats in /proc/net/netstat and /proc/net/snmp, both of which I think come from the net-tools project. Is there any official or unofficial documentation about these fields? Or even a good source of networking terminology that would help identify them?

Some seem pretty clear:

SyncookiesSent
SyncookieFailed
TCPTimeouts
TCPKeepalive

Others less clear:

ActiveOpens
PassiveOpens

Some fully cryptic to me:

EmbryonicRsts
RcvPruned 
... many more ...

Update: I've found definitions in the source but still wondering where these descriptions go. Are they compiled and published anywhere?

6

The /proc/net/* files are generated by the kernel: the entries are in net/ipv4/proc.c in the kernel source, and the entry list is found in include/uapi/linux/snmp.h. It grabs the values from various MIB databases that the kernel keeps.

According to the snmp.h header file, the MIB definitions come from the following documents:

ActiveOpens is from RFC 1213 (page 47):

tcpActiveOpens OBJECT-TYPE
          SYNTAX  Counter
          ACCESS  read-only
          STATUS  mandatory
          DESCRIPTION
                  "The number of times TCP connections have made a
                  direct transition to the SYN-SENT state from the
                  CLOSED state."
          ::= { tcp 5 }

If you can't find the netstat entry in the RFCs, you'll have to search around. Quite a few of the items are not listed in detail in these documents. If you want more than the brief summary, you'll have to search the kernel source for some of the entries that you described.

EmbryonicRsts is modified in net/ipv4/tcp_minisocks.c (line 796 in 4.16.0), and appears to count invalid SYN resets on non-fast opened connections. This is probably not likely to occur unless you're in a SYN cookie flood.

  • I only regret that I have but one upvote to give ;) So then the definitions in the net-tools source I linked must be duplicate and while they may be accurate are not "canonical"? – mjb2kmn Apr 5 '18 at 13:00
  • Outside of the LKML, that may be the next best thing to canonical. My feeling is that a lot of the people who contribute to the tools side also contribute to the kernel side, so they likely have a pretty good idea about what the different items actually do! – ErikF Apr 5 '18 at 13:46
0

netstat -s has comments for each line

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.