Pages

2011-10-20

NIC's errors and dropped

Use ifconfig, like
% ifconfig eth0              
eth0      Link encap:Ethernet  HWaddr 00:24:8C:A1:10:E6  
          inet addr:192.168.9.117  Bcast:192.168.9.255  Mask:255.255.255.0
          inet6 addr: fe80::224:8cff:fea1:10e6/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:3556177 errors:0 dropped:0 overruns:0 frame:0
          TX packets:1232256770 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:661235707 (630.6 MiB)  TX bytes:3049861888 (2.8 GiB)
          Interrupt:43 Base address:0x2000

Some info come from /proc/net/dev, like errors and dropped

What's the meaning of them ?

In net/core/dev.c:
static void dev_seq_printf_stats(struct seq_file *seq, struct net_device *dev)
{
        const struct net_device_stats *stats = dev_get_stats(dev);

        seq_printf(seq, "%6s:%8lu %7lu %4lu %4lu %4lu %5lu %10lu %9lu "
               "%8lu %7lu %4lu %4lu %4lu %5lu %7lu %10lu\n",
               dev->name, stats->rx_bytes, stats->rx_packets,
               stats->rx_errors,
               stats->rx_dropped + stats->rx_missed_errors,
               stats->rx_fifo_errors,
               stats->rx_length_errors + stats->rx_over_errors +
               stats->rx_crc_errors + stats->rx_frame_errors,
               stats->rx_compressed, stats->multicast,
               stats->tx_bytes, stats->tx_packets,
               stats->tx_errors, stats->tx_dropped,
               stats->tx_fifo_errors, stats->collisions,
               stats->tx_carrier_errors +
               stats->tx_aborted_errors +
               stats->tx_window_errors +
               stats->tx_heartbeat_errors,
               stats->tx_compressed);
}

and struct net_device_stats is:
struct net_device_stats
{
        unsigned long rx_packets;  /* total packets received */
        unsigned long tx_packets;  /* total packets transmitted */
        unsigned long rx_bytes;  /* total bytes received  */
        unsigned long tx_bytes;  /* total bytes transmitted */
        unsigned long rx_errors;  /* bad packets received  */
        unsigned long tx_errors;  /* packet transmit problems */
        unsigned long rx_dropped;  /* no space in linux buffers */
        unsigned long tx_dropped;  /* no space available in linux */
        unsigned long multicast;  /* multicast packets received */
        unsigned long collisions;

        /* detailed rx_errors: */
        unsigned long rx_length_errors;
        unsigned long rx_over_errors;  /* receiver ring buff overflow */
        unsigned long rx_crc_errors;  /* recved pkt with crc error */
        unsigned long rx_frame_errors; /* recv'd frame alignment error */
        unsigned long rx_fifo_errors;  /* recv'r fifo overrun  */
        unsigned long rx_missed_errors; /* receiver missed packet */

        /* detailed tx_errors */
        unsigned long tx_aborted_errors;
        unsigned long tx_carrier_errors;
        unsigned long tx_fifo_errors;
        unsigned long tx_heartbeat_errors;
        unsigned long tx_window_errors;

        /* for cslip etc */
        unsigned long rx_compressed;
        unsigned long tx_compressed;
};

Field errors is rx_errors, which is bad packets received, with any invalid fields in ip header, like length or checksum.
Field dropped is rx_dropped (no space in buffers) + rx_missed_errors (receiver missed packet),

When the machine got a lot of packets, such as under ddos attack, the dropped field of the IN port will increase quickly.


Reference:
http://stackoverflow.com/questions/3521678/linux-what-are-means-of-fields-in-proc-net-dev

No comments:

Post a Comment