There is a long list of stats in /proc/net/netstat
and /proc/net/snmp
, both of which I think come from the net-tools project. Is there any official or unofficial documentation about these fields? Or even a good source of networking terminology that would help identify them?
Some seem pretty clear:
SyncookiesSent
SyncookieFailed
TCPTimeouts
TCPKeepalive
Others less clear:
ActiveOpens
PassiveOpens
Some fully cryptic to me:
EmbryonicRsts
RcvPruned
... many more ...
Update: I've found definitions in the source but still wondering where these descriptions go. Are they compiled and published anywhere?
Best Answer
The
/proc/net/*
files are generated by the kernel: the entries are innet/ipv4/proc.c
in the kernel source, and the entry list is found ininclude/uapi/linux/snmp.h
. It grabs the values from various MIB databases that the kernel keeps.According to the
snmp.h
header file, the MIB definitions come from the following documents:draft-ietf-ipv6-rfc2011-update-10.txt
: MIB for IP: IP Statistics TablesActiveOpens
is from RFC 1213 (page 47):If you can't find the
netstat
entry in the RFCs, you'll have to search around. Quite a few of the items are not listed in detail in these documents. If you want more than the brief summary, you'll have to search the kernel source for some of the entries that you described.EmbryonicRsts
is modified innet/ipv4/tcp_minisocks.c
(line 796 in 4.16.0), and appears to count invalid SYN resets on non-fast opened connections. This is probably not likely to occur unless you're in a SYN cookie flood.