Interface statistics¶
This document is a guide to Linux network interface statistics.
There are three main sources of interface statistics in Linux:
- standard interface statistics based on struct rtnl_link_stats64 ;
- protocol-specific statistics; and
- driver-defined statistics available via ethtool.
Standard interface statistics¶
There are multiple interfaces to reach the standard statistics. Most commonly used is the ip command from iproute2 :
$ ip -s -s link show dev ens4u1u1 6: ens4u1u1: mtu 1500 qdisc fq_codel state UP mode DEFAULT group default qlen 1000 link/ether 48:2a:e3:4c:b1:d1 brd ff:ff:ff:ff:ff:ff RX: bytes packets errors dropped overrun mcast 74327665117 69016965 0 0 0 0 RX errors: length crc frame fifo missed 0 0 0 0 0 TX: bytes packets errors dropped carrier collsns 21405556176 44608960 0 0 0 0 TX errors: aborted fifo window heartbeat transns 0 0 0 0 128 altname enp58s0u1u1
Note that -s has been specified twice to see all members of struct rtnl_link_stats64 . If -s is specified once the detailed errors won’t be shown.
ip supports JSON formatting via the -j option.
Protocol-specific statistics¶
Protocol-specific statistics are exposed via relevant interfaces, the same interfaces as are used to configure them.
ethtool¶
Ethtool exposes common low-level statistics. All the standard statistics are expected to be maintained by the device, not the driver (as opposed to driver-defined stats described in the next section which mix software and hardware stats). For devices which contain unmanaged switches (e.g. legacy SR-IOV or multi-host NICs) the events counted may not pertain exclusively to the packets destined to the local host interface. In other words the events may be counted at the network port (MAC/PHY blocks) without separation for different host side (PCIe) devices. Such ambiguity must not be present when internal switch is managed by Linux (so called switchdev mode for NICs).
Standard ethtool statistics can be accessed via the interfaces used for configuration. For example ethtool interface used to configure pause frames can report corresponding hardware counters:
$ ethtool --include-statistics -a eth0 Pause parameters for eth0: Autonegotiate: on RX: on TX: on Statistics: tx_pause_frames: 1 rx_pause_frames: 1
General Ethernet statistics not associated with any particular functionality are exposed via ethtool -S $ifc by specifying the —groups parameter:
$ ethtool -S eth0 --groups eth-phy eth-mac eth-ctrl rmon Stats for eth0: eth-phy-SymbolErrorDuringCarrier: 0 eth-mac-FramesTransmittedOK: 1 eth-mac-FrameTooLongErrors: 1 eth-ctrl-MACControlFramesTransmitted: 1 eth-ctrl-MACControlFramesReceived: 0 eth-ctrl-UnsupportedOpcodesReceived: 1 rmon-etherStatsUndersizePkts: 1 rmon-etherStatsJabbers: 0 rmon-rx-etherStatsPkts64Octets: 1 rmon-rx-etherStatsPkts65to127Octets: 0 rmon-rx-etherStatsPkts128to255Octets: 0 rmon-tx-etherStatsPkts64Octets: 2 rmon-tx-etherStatsPkts65to127Octets: 3 rmon-tx-etherStatsPkts128to255Octets: 0
Driver-defined statistics¶
Driver-defined ethtool statistics can be dumped using ethtool -S $ifc , e.g.:
$ ethtool -S ens4u1u1 NIC statistics: tx_single_collisions: 0 tx_multi_collisions: 0
uAPIs¶
procfs¶
The historical /proc/net/dev text interface gives access to the list of interfaces as well as their statistics.
Note that even though this interface is using struct rtnl_link_stats64 internally it combines some of the fields.
sysfs¶
Each device directory in sysfs contains a statistics directory (e.g. /sys/class/net/lo/statistics/ ) with files corresponding to members of struct rtnl_link_stats64 .
This simple interface is convenient especially in constrained/embedded environments without access to tools. However, it’s inefficient when reading multiple stats as it internally performs a full dump of struct rtnl_link_stats64 and reports only the stat corresponding to the accessed file.
Sysfs files are documented in Documentation/ABI/testing/sysfs-class-net-statistics .
netlink¶
rtnetlink ( NETLINK_ROUTE ) is the preferred method of accessing struct rtnl_link_stats64 stats.
Statistics are reported both in the responses to link information requests ( RTM_GETLINK ) and statistic requests ( RTM_GETSTATS , when IFLA_STATS_LINK_64 bit is set in the .filter_mask of the request).
ethtool¶
Ethtool IOCTL interface allows drivers to report implementation specific statistics. Historically it has also been used to report statistics for which other APIs did not exist, like per-device-queue statistics, or standard-based statistics (e.g. RFC 2863).
Statistics and their string identifiers are retrieved separately. Identifiers via ETHTOOL_GSTRINGS with string_set set to ETH_SS_STATS , and values via ETHTOOL_GSTATS . User space should use ETHTOOL_GDRVINFO to retrieve the number of statistics ( .n_stats ).
ethtool-netlink¶
Ethtool netlink is a replacement for the older IOCTL interface.
Protocol-related statistics can be requested in get commands by setting the ETHTOOL_FLAG_STATS flag in ETHTOOL_A_HEADER_FLAGS . Currently statistics are supported in the following commands:
debugfs¶
Some drivers expose extra statistics via debugfs .
struct rtnl_link_stats64¶
The main device statistics structure.
Number of good packets received by the interface. For hardware interfaces counts all good packets received from the device by the host, including packets which host had to drop at various stages of processing (even in the driver).
Number of packets successfully transmitted. For hardware interfaces counts packets which host was able to successfully hand over to the device, which does not necessarily mean that packets had been successfully transmitted out of the device, only that device acknowledged it copied them out of host memory.
Number of good received bytes, corresponding to rx_packets.
For IEEE 802.3 devices should count the length of Ethernet Frames excluding the FCS.
Number of good transmitted bytes, corresponding to tx_packets.
For IEEE 802.3 devices should count the length of Ethernet Frames excluding the FCS.
Total number of bad packets received on this network device. This counter must include events counted by rx_length_errors, rx_crc_errors, rx_frame_errors and other errors not otherwise counted.
Total number of transmit problems. This counter must include events counter by tx_aborted_errors, tx_carrier_errors, tx_fifo_errors, tx_heartbeat_errors, tx_window_errors and other errors not otherwise counted.
Number of packets received but not processed, e.g. due to lack of resources or unsupported protocol. For hardware interfaces this counter may include packets discarded due to L2 address filtering but should not include packets dropped by the device due to buffer exhaustion which are counted separately in rx_missed_errors (since procfs folds those two counters together).
Number of packets dropped on their way to transmission, e.g. due to lack of resources.
Multicast packets received. For hardware interfaces this statistic is commonly calculated at the device level (unlike rx_packets) and therefore may include packets which did not reach the host.
For IEEE 802.3 devices this counter may be equivalent to:
Number of collisions during packet transmissions.
Number of packets dropped due to invalid length. Part of aggregate «frame» errors in /proc/net/dev .
For IEEE 802.3 devices this counter should be equivalent to a sum of the following attributes:
- 30.3.1.1.23 aInRangeLengthErrors
- 30.3.1.1.24 aOutOfRangeLengthField
- 30.3.1.1.25 aFrameTooLongErrors
Receiver FIFO overflow event counter.
Historically the count of overflow events. Such events may be reported in the receive descriptors or via interrupts, and may not correspond one-to-one with dropped packets.
The recommended interpretation for high speed interfaces is — number of packets dropped because they did not fit into buffers provided by the host, e.g. packets larger than MTU or next buffer in the ring was not available for a scatter transfer.
Part of aggregate «frame» errors in /proc/net/dev .
This statistics was historically used interchangeably with rx_fifo_errors.
This statistic corresponds to hardware events and is not commonly used on software devices.
Number of packets received with a CRC error. Part of aggregate «frame» errors in /proc/net/dev .
For IEEE 802.3 devices this counter must be equivalent to:
Receiver frame alignment errors. Part of aggregate «frame» errors in /proc/net/dev .
For IEEE 802.3 devices this counter should be equivalent to:
Receiver FIFO error counter.
Historically the count of overflow events. Those events may be reported in the receive descriptors or via interrupts, and may not correspond one-to-one with dropped packets.
This statistics was used interchangeably with rx_over_errors. Not recommended for use in drivers for high speed interfaces.
This statistic is used on software devices, e.g. to count software packet queue overflow (can) or sequencing errors (GRE).
Count of packets missed by the host. Folded into the «drop» counter in /proc/net/dev .
Counts number of packets dropped by the device due to lack of buffer space. This usually indicates that the host interface is slower than the network interface, or host is not keeping up with the receive packet rate.
This statistic corresponds to hardware events and is not used on software devices.
Part of aggregate «carrier» errors in /proc/net/dev . For IEEE 802.3 devices capable of half-duplex operation this counter must be equivalent to:
High speed interfaces may use this counter as a general device discard counter.
Number of frame transmission errors due to loss of carrier during transmission. Part of aggregate «carrier» errors in /proc/net/dev .
For IEEE 802.3 devices this counter must be equivalent to:
Number of frame transmission errors due to device FIFO underrun / underflow. This condition occurs when the device begins transmission of a frame but is unable to deliver the entire frame to the transmitter in time for transmission. Part of aggregate «carrier» errors in /proc/net/dev .
Number of Heartbeat / SQE Test errors for old half-duplex Ethernet. Part of aggregate «carrier» errors in /proc/net/dev .
For IEEE 802.3 devices possibly equivalent to:
Number of frame transmission errors due to late collisions (for Ethernet — after the first 64B of transmission). Part of aggregate «carrier» errors in /proc/net/dev .
For IEEE 802.3 devices this counter must be equivalent to:
Number of correctly received compressed packets. This counters is only meaningful for interfaces which support packet compression (e.g. CSLIP, PPP).
Number of transmitted compressed packets. This counters is only meaningful for interfaces which support packet compression (e.g. CSLIP, PPP).
Number of packets received on the interface but dropped by the networking stack because the device is not designated to receive packets (e.g. backup link in a bond).
Number of packets dropped due to mismatch in destination MAC address.
Notes for driver authors¶
Drivers should report all statistics which have a matching member in struct rtnl_link_stats64 exclusively via .ndo_get_stats64 . Reporting such standard stats via ethtool or debugfs will not be accepted.
Drivers must ensure best possible compliance with struct rtnl_link_stats64 . Please note for example that detailed error statistics must be added into the general rx_error / tx_error counters.
The .ndo_get_stats64 callback can not sleep because of accesses via /proc/net/dev . If driver may sleep when retrieving the statistics from the device it should do so periodically asynchronously and only return a recent copy from .ndo_get_stats64 . Ethtool interrupt coalescing interface allows setting the frequency of refreshing statistics, if needed.
Retrieving ethtool statistics is a multi-syscall process, drivers are advised to keep the number of statistics constant to avoid race conditions with user space trying to read them.
Statistics must persist across routine operations like bringing the interface down and up.
Kernel-internal data structures¶
The following structures are internal to the kernel, their members are translated to netlink attributes when dumped. Drivers must not overwrite the statistics they don’t report with 0.