Looking at Linux Network Buffers

[scottalanmiller]

Linux has two key buffers or queues where network data is going to pass as it goes through the system.

Viewing these buffers from the network side inbound, the first is the NIC driver buffer. This is the FIFO ring buffer that exists in the NIC driver and is the first line of defense against packets coming in faster than the system can ingest them.

We can view the stats on the ring buffer using the ethtool -S eth0 command, assuming that eth0 is the name of the NIC that you want to investigate. The -S option will provide a bit of output. But it is valuable.

[samiller@mi-lnx-dev tmp]$ ethtool -S eth0
NIC statistics:
	 Tx Queue#: 0
	   TSO pkts tx: 3787
	   TSO bytes tx: 6404878
	   ucast pkts tx: 229365
	   ucast bytes tx: 48271011
	   mcast pkts tx: 35
	   mcast bytes tx: 4414
	   bcast pkts tx: 3
	   bcast bytes tx: 126
	   pkts tx err: 0
	   pkts tx discard: 0
	   drv dropped tx total: 0
		  too many frags: 0
		  giant hdr: 0
		  hdr err: 0
		  tso: 0
	   ring full: 0
	   pkts linearized: 0
	   hdr cloned: 0
	   giant hdr: 0
	 Rx Queue#: 0
	   LRO pkts rx: 1
	   LRO byte rx: 1650
	   ucast pkts rx: 196981
	   ucast bytes rx: 18752382
	   mcast pkts rx: 0
	   mcast bytes rx: 0
	   bcast pkts rx: 1949
	   bcast bytes rx: 116940
	   pkts rx OOB: 0
	   pkts rx err: 0
	   drv dropped rx total: 0
		  err: 0
		  fcs: 0
	   rx buf alloc fail: 0
	 tx timeout count: 0

In this case we can see that no packets have been dropped and ring buffer has never been filled.

The netstat command offers a lot of information about our network, as you would expect. The netstat -i command gives us a quick overview of the network state.

[samiller@mi-lnx-dev tmp]$ netstat -i
Kernel Interface table
Iface      MTU    RX-OK RX-ERR RX-DRP RX-OVR    TX-OK TX-ERR TX-DRP TX-OVR Flg
eth0      1500   205307      0      0 0        237048      0      0      0 BMRU
lo       65536       20      0      0 0            20      0      0      0 LRU

We can see that no packets have been dropped here, so things are looking good. The RX-DRP and TX-DRP fields indicate errors from packets being dropped because the receive (RX) and transmit/send (TX) buffers were full. The RX-OVR and TX-OVR indicate that the CPU was so busy that it could not pick up the packets.

[nadnerB]

Thanks, I'll have a go at this when the little tacker is in bed.

Is there a Linux equivalent if ncpa.cpl?
Or better yet a command to view all if the network adapters, WLAN included?

[scottalanmiller]

You can use something like netstat to get a list of adapters and then cycle through them. That would work easily enough.

for i in $(netstat -i | cut -d' ' -f1 | grep -v Iface | grep -v lo | grep -v Kernel); do ethtool -S $i; done