There is a long list of stats in /proc/net/netstat and /proc/net/snmp, both of which I think come from the net-tools project. Is there any official or unofficial documentation about these fields? Or even a good source of networking terminology that would help identify them?

Some seem pretty clear:


Others less clear:


Some fully cryptic to me:

... many more ...

Update: I've found definitions in the source but still wondering where these descriptions go. Are they compiled and published anywhere?

2 Answers 2


The /proc/net/* files are generated by the kernel: the entries are in net/ipv4/proc.c in the kernel source, and the entry list is found in include/uapi/linux/snmp.h. It grabs the values from various MIB databases that the kernel keeps.

According to the snmp.h header file, the MIB definitions come from the following documents:

ActiveOpens is from RFC 1213 (page 47):

tcpActiveOpens OBJECT-TYPE
          SYNTAX  Counter
          ACCESS  read-only
          STATUS  mandatory
                  "The number of times TCP connections have made a
                  direct transition to the SYN-SENT state from the
                  CLOSED state."
          ::= { tcp 5 }

If you can't find the netstat entry in the RFCs, you'll have to search around. Quite a few of the items are not listed in detail in these documents. If you want more than the brief summary, you'll have to search the kernel source for some of the entries that you described.

EmbryonicRsts is modified in net/ipv4/tcp_minisocks.c, at line 796 in Linux 4.16 at least, and appears to count invalid SYN resets on non-fast opened connections. This is probably not likely to occur unless you're in a SYN cookie flood.

  • 1
    I only regret that I have but one upvote to give ;) So then the definitions in the net-tools source I linked must be duplicate and while they may be accurate are not "canonical"?
    – virullius
    Apr 5, 2018 at 13:00
  • Outside of the LKML, that may be the next best thing to canonical. My feeling is that a lot of the people who contribute to the tools side also contribute to the kernel side, so they likely have a pretty good idea about what the different items actually do!
    – ErikF
    Apr 5, 2018 at 13:46

netstat -s has comments for each line

  • Is there a flag to read the value of ListenOverflows?
    – Karl Pokus
    Apr 30, 2020 at 9:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .