Key Files in /proc/net
ls /proc/net/
# arp ← ARP table (IP to MAC mappings)
# dev ← interface statistics (bytes, packets, errors, drops)
# if_inet6 ← IPv6 interface addresses
# nf_conntrack ← connection tracking table
# route ← IPv4 routing table (hex format)
# tcp ← TCP connections
# tcp6 ← TCP6 connections
# udp ← UDP sockets
# udp6 ← UDP6 sockets
# unix ← Unix domain socket connections
# sockstat ← summary counts of open sockets
# snmp ← SNMP counters (TCP retransmits, etc.)
# netstat ← extended SNMP counters
/proc/net/dev — Interface Statistics
cat /proc/net/dev
# Inter-| Receive | Transmit
# face |bytes packets errs drop fifo frame multi |bytes packets errs drop ...
# lo: 123456 1234 0 0 0 0 0 123456 1234 0 0
# eth0: 987654321 876543 0 5 0 0 0 12345678 98765 0 0
# ^ RX drops!
# Key columns:
# bytes = total bytes received/transmitted
# packets = total packets
# errs = hardware errors (NIC problems)
# drop = dropped packets (no buffer space)
# fifo = FIFO overflows
# frame = framing errors (bad data from cable/NIC)
# Quick monitoring:
watch -n1 "cat /proc/net/dev | grep eth0"
# Or use: ip -s link show eth0
# Or use: ifstat / nload / iftop
/proc/net/tcp — TCP Connections
cat /proc/net/tcp
# sl local_address rem_address st tx_queue rx_queue uid inode
# 0: 00000000:0016 00000000:0000 0A 00000000:00000000 0 1234
# ^ ^ ^
# local (hex) remote (hex) state (0A=LISTEN)
# State codes:
# 01=ESTABLISHED 02=SYN_SENT 03=SYN_RECV
# 04=FIN_WAIT1 05=FIN_WAIT2 06=TIME_WAIT
# 07=CLOSE 08=CLOSE_WAIT 09=LAST_ACK
# 0A=LISTEN 0B=CLOSING
# Decode hex address (little-endian):
# 00000000:0016 → 0.0.0.0:22 (0x16 = 22)
# 0101A8C0:0050 → 192.168.1.1:80
# Python: socket.inet_ntoa(struct.pack("
# Count connections by state:
awk 'NR>1 {print $4}' /proc/net/tcp | sort | uniq -c
# 48 01 ← 48 ESTABLISHED
# 2 06 ← 2 TIME_WAIT
# 5 0A ← 5 LISTEN
/proc/net/sockstat — Socket Summary
cat /proc/net/sockstat
# sockets: used 512
# TCP: inuse 48 orphan 2 tw 12 alloc 62 mem 35
# UDP: inuse 8 mem 3
# UDPLITE: inuse 0
# RAW: inuse 0
# FRAG: inuse 0 memory 0
# Definitions:
# inuse = currently active sockets
# orphan = TCP sockets with no owning file descriptor (closed but not fully gone)
# tw = TIME_WAIT sockets (normal after connections close)
# alloc = allocated (including in kernel queues)
# mem = pages used for socket buffers
# High orphan count = application closing connections without reading data
# High tw count = normal under load, can tune with tcp_tw_reuse
/proc/net/snmp — TCP Performance Counters
cat /proc/net/snmp | grep -A1 Tcp
# Tcp: RtoAlgorithm RtoMin RtoMax MaxConn ActiveOpens PassiveOpens ...
# 1 200 120000 -1 12345 8901 ...
# Key fields:
# RetransSegs = TCP retransmissions (packet loss indicator)
# InErrs = bad TCP segments received
# OutRsts = RST packets sent (connection refused/reset)
# Watch retransmits (high = packet loss / congestion):
watch -n5 "cat /proc/net/snmp | awk '/^Tcp:/ {getline; print \"Retrans:\", \$13}'"
# Alternative: nstat (cleaner output, shows deltas)
nstat -az | grep Tcp
/proc/net/arp — ARP Table
cat /proc/net/arp
# IP address HW type Flags HW address Mask Device
# 192.168.1.1 0x1 0x2 aa:bb:cc:dd:ee:ff * eth0
# 192.168.1.100 0x1 0x2 11:22:33:44:55:66 * eth0
# Flags: 0x2 = complete (resolved), 0x6 = incomplete
# Or use: ip neigh show
# 192.168.1.1 dev eth0 lladdr aa:bb:cc:dd:ee:ff REACHABLE
# Flush ARP cache (force re-resolution):
ip neigh flush dev eth0