/proc/net

ls /proc/net/ # arp ← ARP table (IP to MAC mappings) # dev ← interface statistics (bytes, packets, errors, drops) # if_inet6 ← IPv6 interface addresses # nf_conntrack ← connection tracking table # route ← IPv4 routing table (hex format) # tcp ← TCP connections # tcp6 ← TCP6 connections # udp ← UDP sockets # udp6 ← UDP6 sockets # unix ← Unix domain socket connections # sockstat ← summary counts of open sockets # snmp ← SNMP counters (TCP retransmits, etc.) # netstat ← extended SNMP counters

cat /proc/net/dev # Inter-| Receive | Transmit # face |bytes packets errs drop fifo frame multi |bytes packets errs drop ... # lo: 123456 1234 0 0 0 0 0 123456 1234 0 0 # eth0: 987654321 876543 0 5 0 0 0 12345678 98765 0 0 # ^ RX drops! # Key columns: # bytes = total bytes received/transmitted # packets = total packets # errs = hardware errors (NIC problems) # drop = dropped packets (no buffer space) # fifo = FIFO overflows # frame = framing errors (bad data from cable/NIC) # Quick monitoring: watch -n1 "cat /proc/net/dev | grep eth0" # Or use: ip -s link show eth0 # Or use: ifstat / nload / iftop

cat /proc/net/tcp # sl local_address rem_address st tx_queue rx_queue uid inode # 0: 00000000:0016 00000000:0000 0A 00000000:00000000 0 1234 # ^ ^ ^ # local (hex) remote (hex) state (0A=LISTEN) # State codes: # 01=ESTABLISHED 02=SYN_SENT 03=SYN_RECV # 04=FIN_WAIT1 05=FIN_WAIT2 06=TIME_WAIT # 07=CLOSE 08=CLOSE_WAIT 09=LAST_ACK # 0A=LISTEN 0B=CLOSING # Decode hex address (little-endian): # 00000000:0016 → 0.0.0.0:22 (0x16 = 22) # 0101A8C0:0050 → 192.168.1.1:80 # Python: socket.inet_ntoa(struct.pack(" # Count connections by state: awk 'NR>1 {print $4}' /proc/net/tcp | sort | uniq -c # 48 01 ← 48 ESTABLISHED # 2 06 ← 2 TIME_WAIT # 5 0A ← 5 LISTEN

cat /proc/net/sockstat # sockets: used 512 # TCP: inuse 48 orphan 2 tw 12 alloc 62 mem 35 # UDP: inuse 8 mem 3 # UDPLITE: inuse 0 # RAW: inuse 0 # FRAG: inuse 0 memory 0 # Definitions: # inuse = currently active sockets # orphan = TCP sockets with no owning file descriptor (closed but not fully gone) # tw = TIME_WAIT sockets (normal after connections close) # alloc = allocated (including in kernel queues) # mem = pages used for socket buffers # High orphan count = application closing connections without reading data # High tw count = normal under load, can tune with tcp_tw_reuse

cat /proc/net/snmp | grep -A1 Tcp # Tcp: RtoAlgorithm RtoMin RtoMax MaxConn ActiveOpens PassiveOpens ... # 1 200 120000 -1 12345 8901 ... # Key fields: # RetransSegs = TCP retransmissions (packet loss indicator) # InErrs = bad TCP segments received # OutRsts = RST packets sent (connection refused/reset) # Watch retransmits (high = packet loss / congestion): watch -n5 "cat /proc/net/snmp | awk '/^Tcp:/ {getline; print \"Retrans:\", \$13}'" # Alternative: nstat (cleaner output, shows deltas) nstat -az | grep Tcp

cat /proc/net/arp # IP address HW type Flags HW address Mask Device # 192.168.1.1 0x1 0x2 aa:bb:cc:dd:ee:ff * eth0 # 192.168.1.100 0x1 0x2 11:22:33:44:55:66 * eth0 # Flags: 0x2 = complete (resolved), 0x6 = incomplete # Or use: ip neigh show # 192.168.1.1 dev eth0 lladdr aa:bb:cc:dd:ee:ff REACHABLE # Flush ARP cache (force re-resolution): ip neigh flush dev eth0