"netstat -s"

Hello group,

I am looking for explanation of output generated by 'netstat -s'

specifically explanation of each of these entries:-

TCPPureAcks: 3568472
TCPHPAcks: 2188686
TCPRenoRecovery: 0
TCPSackRecovery: 897
TCPSACKReneging: 0
TCPFACKReorder: 0
TCPSACKReorder: 0
TCPRenoReorder: 0
TCPTSReorder: 0
TCPFullUndo: 0
TCPPartialUndo: 0
TCPDSACKUndo: 0
TCPLossUndo: 207
TCPLoss: 886
TCPLostRetransmit: 0
TCPRenoFailures: 1
TCPSackFailures: 78
TCPLossFailures: 1
TCPFastRetrans: 911
TCPForwardRetrans: 2
TCPSlowStartRetrans: 16
TCPTimeouts: 1462
TCPRenoRecoveryFail: 0
TCPSackRecoveryFail: 878
TCPSchedulerFailed: 0
TCPRcvCollapsed: 0
TCPDSACKOldSent: 1835
TCPDSACKOfoSent: 34
TCPDSACKRecv: 5
TCPDSACKOfoRecv: 0
TCPAbortOnSyn: 0
TCPAbortOnData: 43
TCPAbortOnClose: 764
TCPAbortOnMemory: 0
TCPAbortOnTimeout: 20
TCPAbortOnLinger: 0
TCPAbortFailed: 0
TCPMemoryPressures: 0

Thank you for your time and support.

Sidharth Deshpande

sidharth deshpande <sidharth.deshpande@fh-heidelberg.de> wrote:
> Hello group,
>
> I am looking for explanation of output generated by 'netstat -s'

My 'netstat -s' doesn't mention those at all, nor is it in the some
format.

> specifically explanation of each of these entries:-
> TCPPureAcks: 3568472
> TCPHPAcks: 2188686
> TCPRenoRecovery: 0
> TCPSackRecovery: 897
....

Hmmm, a lot of counters. I think the version I have (Debian Unstable) is
the modern version. As such, it would seem the output has been made a
bit more informational. Here's a sample of what I have. You can piece it
together if you like.

Ip:
...
Icmp:
...
Tcp:
...
Udp:
...
TcpExt:
56 TCP sockets finished time wait in fast timer
2984 delayed acks sent
Quick ack mode was activated 5 times
61 packets directly queued to recvmsg prequeue.
747 of bytes directly received from backlog
21366 of bytes directly received from prequeue
91368 packet headers predicted
...

It seems (via a simple
"strace -o /dev/stderr -e open netstat -s > /dev/null"
that it gets its data from /proc/net/{snmp,netstat}

So digging around the kernel source in files related to that may turn up
more information.

In particular, rooting around for NET_INC_STATS or NET_ADD_STATS may be useful.

Also, RFC's may be useful here (try searching for TCP MIB)

Specifically, RFC1156 may be enlightening for you.
ftp://ftp.rfc-editor.org/in-notes/rfc1156.txt
However, I don't think it covers the Extended TCP stuff at all.

Perhaps a search for Linux MIB or linux_mib may be useful (esp in the
kernel source). It seems to pop up a few times.

Hmmm, yes, searching for linux_mib would be the right thing to search
for, except there doesn't appear to be any documenould be the right
thing to search for, except there doesn't appear to be any documentation
on it. This would appear to be because the linux_mib stuff is intended
for debugging purposes, and all the other netstat -s sections, such as
TCP, UDP, etc, are documented in their own MIB RFCs.

Oh well, you could always ask the Linux Kernel Mailing List. I think
they have the mailing list gatewayed to a newsgroup (it's a very busy
list, not that I've ever been a subscriber)

--
Cameron Kerr
cameron.kerr@paradise.net.nz : http://nzgeeks.org/cameron/
Empowered by Perl!

sidharth deshpande <sidharth.deshpande@fh-heidelberg.de> wrote:
> Hello group,

> I am looking for explanation of output generated by 'netstat -s'

> specifically explanation of each of these entries:-

Don't know about any "official" definition for these, perhaps RFC
2012 might be helpful (www.faqs.org)

> TCPPureAcks: 3568472

Only ack received, no data was sent.

> TCPHPAcks: 2188686

Probably some ack received in TCP fast path (header prediction
path. Look at tcp_ack() in tcp_input.c (kernel sources)

--
Michael Heiming

Remove +SIGNS and www. if you expect an answer, sorry for
inconvenience, but I get tons of SPAM