Hi.


Although I consider myself to know a reasonable amount about the
TCP/IP protocol suite, I still find myself wondering from time to time
how to interpret the output of the 'netstat -s' command correctly.
Unfortunately, the manual page of netstat is not all that helpfull on
this subject. Can anyone point me to any documentation that describes
more clearly how to interpret this information ?


I have included the output of netstat -s -f inet of my system at the
end of this thread for reference.

For example, how to interpret the ack received info ?

9939037 acks (for 914538459 bytes)
529092 duplicate acks

Are the "9939037 acks" the total amount of acks (duplicate acks
included), or should I first add up the "9939037 acks" and the "529092
duplicate acks" to get the total amount of acks received. This is of
interest to me because I would like to know the percentage of
duplicate acks received out of the total amount of acks received.

As another example, what does the tcp output "embryonic connections
dropped" mean ? What are "embryonic connections" anyways ? All
connections that havent finished the three-way-handshake yet ?
Something else ?

And what about the ip info "with data size < data length", "with
header length < data size", and "with data length < header length" ?
Does this refer to length as specified in the IP header versus the
'actual' length as seen on the wire ?

How about the tcp info "large sends" ? What exactly qualifies as a
"large send" ?

Or "spliced connections" ? Is that a connection that has only one half
of the connection closed ?

Or what is meant by "send_and_disconnects" ?

All these kinds of things arent found in the netstat manual page.



Sincerely,

John Smith

---------------------------------------------------------------------

ip:
11772048 total packets received
0 bad header checksums
0 with size smaller than minimum
0 with data size < data length
0 with header length < data size
0 with data length < header length
0 with bad options
0 with incorrect version number
0 fragments received
0 fragments dropped (dup or out of space)
0 fragments dropped after timeout
0 packets reassembled ok
11762905 packets for this host
9143 packets for unknown/unsupported protocol
0 packets forwarded
0 packets not forwardable
0 redirects sent
3213570 packets sent from this host
0 packets sent with fabricated ip header
0 output packets dropped due to no bufs, etc.
0 output packets discarded due to no route
0 output datagrams fragmented
0 fragments created
0 datagrams that can't be fragmented
0 IP Multicast packets dropped due to no receiver
0 successful path MTU discovery cycles
0 path MTU rediscovery cycles attempted
0 path MTU discovery no-response estimates
0 path MTU discovery response timeouts
0 path MTU discovery decreases detected
0 path MTU discovery packets sent
0 path MTU discovery memory allocation failures
0 ipintrq overflows
0 with illegal source
0 packets processed by threads
0 packets dropped by threads
130409 packets dropped due to the full socket receive buffer
0 dead gateway detection packets sent
0 dead gateway detection packet allocation failures
0 dead gateway detection gateway allocation failures
icmp:
99536 calls to icmp_error
0 errors not generated because old message was icmp
Output histogram:
echo reply: 837
destination unreachable: 95904
0 messages with bad code fields
0 messages < minimum length
0 bad checksums
0 messages with bad length
Input histogram:
echo reply: 4
destination unreachable: 95909
echo: 837
837 message responses generated
igmp:
4 messages received
0 messages received with too few bytes
0 messages received with bad checksum
0 membership queries received
0 membership queries received with invalid field(s)
4 membership reports received
0 membership reports received with invalid field(s)
4 membership reports received for groups to which we belong
0 membership reports sent
tcp:
2318697 packets sent
1789975 data packets (903822470 bytes)
87371 data packets (166019965 bytes) retransmitted
264568 ack-only packets (62207 delayed)
0 URG only packets
0 window probe packets
29357 window update packets
147426 control packets
1193887 large sends
619272397 bytes sent using largesend
65160 bytes is the biggest largesend
10901621 packets received
9939037 acks (for 914538459 bytes)
529092 duplicate acks
0 acks for unsent data
517537 packets (133516481 bytes) received in-sequence
2554 completely duplicate packets (123107 bytes)
0 old duplicate packets
2 packets with some dup. data (584 bytes duped)
50459 out-of-order packets (245124 bytes)
0 packets (0 bytes) of data after window
0 window probes
151855 window update packets
1 packet received after close
0 packets with bad hardware assisted checksum
0 discarded for bad checksums
0 discarded for bad header offset fields
0 discarded because packet too short
0 discarded by listeners
1637352 ack packet headers correctly predicted
177385 data packet headers correctly predicted
47554 connection requests
52273 connection accepts
99827 connections established (including accepts)
121785 connections closed (including 3 drops)
0 connections with ECN capability
0 times responded to ECN
0 embryonic connections dropped
9986353 segments updated rtt (of 1765642 attempts)
0 segments with congestion window reduced bit set
0 segments with congestion experienced bit set
0 resends due to path MTU discovery
0 path MTU discovery terminations due to retransmits
9337 retransmit timeouts
0 connections dropped by rexmit timeout
17136 fast retransmits
42 when congestion window less than 4 segments
45104 newreno retransmits
670 times avoided false fast retransmits
1679 persist timeouts
0 connections dropped due to persist timeout
165 keepalive timeouts
165 keepalive probes sent
0 connections dropped by keepalive
1 time SACK blocks array is extended
22 times SACK holes array is extended
0 packets dropped due to memory allocation failure
0 connections in timewait reused
0 delayed ACKs for SYN
0 delayed ACKs for FIN
0 send_and_disconnects
0 spliced connections
0 spliced connections closed
0 spliced connections reset
0 spliced connections timeout
0 spliced connections persist timeout
0 spliced connections keepalive timeout
udp:
773672 datagrams received
0 incomplete headers
0 bad data length fields
0 bad checksums
99536 dropped due to no socket
0 broadcast/multicast datagrams dropped due to no socket
0 socket buffer overflows
674136 delivered
797414 datagrams output