Is there documentation for /proc/net/netstat and /proc/net/snmp

documentationnetstatproc

There is a long list of stats in /proc/net/netstat and /proc/net/snmp, both of which I think come from the net-tools project. Is there any official or unofficial documentation about these fields? Or even a good source of networking terminology that would help identify them?

Some seem pretty clear:

SyncookiesSent
SyncookieFailed
TCPTimeouts
TCPKeepalive

Others less clear:

ActiveOpens
PassiveOpens

Some fully cryptic to me:

EmbryonicRsts
RcvPruned 
... many more ...

Update: I've found definitions in the source but still wondering where these descriptions go. Are they compiled and published anywhere?

Best Answer

The /proc/net/* files are generated by the kernel: the entries are in net/ipv4/proc.c in the kernel source, and the entry list is found in include/uapi/linux/snmp.h. It grabs the values from various MIB databases that the kernel keeps.

According to the snmp.h header file, the MIB definitions come from the following documents:

ActiveOpens is from RFC 1213 (page 47):

tcpActiveOpens OBJECT-TYPE
          SYNTAX  Counter
          ACCESS  read-only
          STATUS  mandatory
          DESCRIPTION
                  "The number of times TCP connections have made a
                  direct transition to the SYN-SENT state from the
                  CLOSED state."
          ::= { tcp 5 }

If you can't find the netstat entry in the RFCs, you'll have to search around. Quite a few of the items are not listed in detail in these documents. If you want more than the brief summary, you'll have to search the kernel source for some of the entries that you described.

EmbryonicRsts is modified in net/ipv4/tcp_minisocks.c (line 796 in 4.16.0), and appears to count invalid SYN resets on non-fast opened connections. This is probably not likely to occur unless you're in a SYN cookie flood.

Related Question