Using netstat for Network Interface Statistics

The netstat command can be used to display a statistical summary of network interfaces on your system. This provides valuable information about how data is being transmitted and received, as well as whether any errors or drops are occurring. Monitoring these statistics is an important part of network administration and troubleshooting.

Example: netstat -i

Running netstat -i shows the kernel interface table:

host$ netstat -i
Kernel Interface table
Iface   MTU  Met  RX-OK   RX-ERR RX-DRP RX-OVR  TX-OK   TX-ERR TX-DRP TX-OVR Flags
lo      3584 0    28473   0      0      0       28473   0      0      0      BLRU
eth0    1500 0    844349  398    398    3       444986  0      0      0      BRU

Understanding the Columns

1. Iface: Name of the network interface (e.g., lo for loopback, eth0 for Ethernet).
2. MTU: Maximum Transmission Unit – the largest packet size that can be sent.
3. Met: Metric value used in routing decisions (usually left at 0 on modern systems).
4. RX fields:
   • RX-OK - packets received successfully.
   • RX-ERR - packets with errors (e.g., checksum failures).
   • RX-DRP - packets dropped before being processed (possible buffer issues).
   • RX-OVR - packets lost due to buffer overruns.
5. TX fields:
   • TX-OK - packets transmitted successfully.
   • TX-ERR - transmit errors (e.g., hardware or driver problems).
   • TX-DRP - dropped packets on transmit.
   • TX-OVR - transmit buffer overflows.
6. Flags: Interface state indicators: U=Up, B=Broadcast, R=Running, L=Loopback. These flags help confirm whether the interface is active and capable of sending/receiving traffic.

Practical Usage

When reviewing interface statistics, focus on error and drop counts. A high number of RX-ERR or TX-ERR values could point to faulty cabling, driver problems, or a congested network. Consistent RX-DRP or TX-DRP values may suggest buffer shortages. Monitoring these counters over time allows administrators to detect and resolve network performance problems early.

Although netstat remains available on many systems, modern Linux distributions recommend using ip -s link or the ss command for more detailed interface and socket statistics.

Quiz: Netstat Connections

Test your understanding of interface statistics: