More details can be found here
- TCP SNMP counters netstat -s each parameter meaning
- Linux SNMP counters
- TCP slow and fast path meaning
-
linux/snmp.h
TCP Basic
| category | name | description |
|---|---|---|
| Tcp | ActiveOpens | tcp_connect(), when sending SYN, add 1 |
| Tcp | PassiveOpens | tcp_create_openreq_child(), passive three-way handshake is completed, add 1 |
| Tcp | AttemptFails | tcp_done(): If you end a connection in the SYN_SENT/SYN_RECV state, add 1 tcp_check_req(): If there is an RST|SYN flag in the input packet in the last stage of the passive three-way handshake, add 1 |
| Tcp | CurrEstab | tcp_set_state(), according to ESTABLISHED is the new/old state, plus or minus one respectively. |
| Tcp | EstabResets | tcp_set_state(), the new state is TCP_CLOSE, if the old state is ESTABLISHED/TCP_CLOSE_WAIT, add 1 |
| Tcp | ListenOverflows | tcp_v4_syn_recv_sock(): After the last step of the three-way handshake is completed, add 1 when the Accept queue exceeds the upper limit |
| Tcp | ListenDrops | tcp_v4_syn_recv_sock(): For any reason, including Accept queue exceeding limit, creating new connection, failure to inherit port, etc., add 1 |
| Tcp | MaxConn | 0 |
| Tcp | InSegs | tcp_v4_rcv(), receive a skb, add 1 |
| Tcp | InErrs | tcp_rcv_established() -> tcp_validate_incoming(): If there is SYN and seq >= rcv_nxt, add 1 In the following function, if the checksum is wrong or the packet length is less than the TCP header, add 1: tcp_v4_do_rcv()tcp_rcv_established()tcp_v4_rcv() |
| Tcp | OutSegs | tcp_v4_send_reset(), tcp_v4_send_ack(), add 1tcp_transmit_skb(), tcp_make_synack(), add tcp_skb_pcount(skb) (see TCP_COOKIE_TRANSACTIONS) |
| Tcp | OutRsts | tcp_v4_send_reset(), tcp_send_active_reset() plus 1 |
TCP Congestion Processing
| category | name | description |
|---|---|---|
| TcpExt | TW | inet_twdr_do_twkill_work(): The number of sockets with TIME_WAIT timeout (timeout >= 4s). The reason why timewait sockets are treated as timeouts may be because the timeout time distribution of long timeout sockets is relatively scattered, and different search methods are required. |
| TcpExt | TWKilled | inet_twdr_twcal_tick(): TIME_WAIT timeout socket number. (timeout <4s), only when sysctl_tw_recycle is enabled, and TCP timestamp option is used, this will happen. At this time, 3.5x RTO is used as timewait timeout, and the default timeout is 60s |
| TcpExt | TWRecycled | tcp_v4_connect() -> __inet_check_established(): During establishment, if the port is reused from the TIME_WAIT socket, add 1 |
| TcpExt | TCPTimeWaitOverflow | tcp_time_wait(): When the system cannot allocate new tcp_timewait_socket, or tw_count (scheduled timewait sockets) exceeds sysctl_max_tw_buckets, add 1 |
| category | name | description |
|---|---|---|
| TcpExt | TCPDSACKUndo | tcp_ack() -> tcp_fastretrans_alrt() -> tcp_try_undo_dsack()In the Disorder state, the number of undo completion (undo_retrans == 0). |
| TcpExt | TCPFullUndo | tcp_ack() -> tcp_fastretrans_alrt() -> tcp_try_undo_recovery()In Recovery state, the number of times that all confirmations (snd_una >= high_seq) have been received and undo has been completed (undo_retrans == 0). |
| TcpExt | TCPPartialUndo | tcp_ack() -> tcp_fastretrans_alrt() -> tcp_undo_partial()In Recovery state, the number of times that a partial confirmation (snd_una <high_seq) has been received but the undo has been completed (undo_retrans == 0). |
| TcpExt | TCPLossUndo | tcp_ack() -> tcp_fastretrans_alrt() -> tcp_try_undo_loss()In Loss state, the number of times that all confirmations (snd_una >= high_seq) have been received and undo has been completed (undo_retrans == 0). |
| TcpExt | TCPRenoReorder | Update in tcp_update_reordering(). When metric > tp -> reordering and SACK is not enabled, this counter is incremented by 1. In summary, when sacked_out is “unreliable”, tp -> reordering is updated to the “used seg” in the current window. “Number, including unconfirmed (and confirmed?) data, but not lost_out. A. tcp_ack() -> tcp_fastretrans_alert() -> tcp_add_reno_sack() -> tcp_check_reno_reordering() -> tcp_update_reordering(): When receiving dupACK in the Open/Recovery/Disorder/CWR state , use the sacked_out + lost_metric> (= packets_out) call tcp_update_reordering() B. tcp_ack() -> tcp_clean_rtx_queue() -> tcp_remove_reno_sacks() -> tcp_check_reno_reordering() -> tcp_update_reordering() : When clearing rtx queues, lost_outets_out will be subtracted from lost_packets_out The number of confirmed segs , if sacked_out + lost_out> packets_out, call tcp_update_reordering() with metric( = packets_out + acked_pcount) Note: sacked_out: the number of dupACK receivedlost_out: Limit the minimum value to 1 and the maximum value to packets_outtp -> reordering: When creating a socket, passively establishing a connection, and entering the Loss state, it is initialized to sysctl_tcp_reordering |
| TcpExt | TCPSACKReorder | Update in tcp_update_reordering(). When metric > tp -> reordering and SACK is enabled but FACK is disabled, this counter is incremented by 1. A. tcp_ack() -> tcp_sacktag_write_queue() -> tcp_update_reordering() will calculate faxes_out in tcp_sacktag_walk() By accumulating state.fack_count), this value is the number of segs from the beginning of snd_una to the highest sequence number of SACK (including those that are not covered by SACK). The conditions for judging the disorder are: (1) D-SACK for retransmission messages is found; (2) The currently received SACK sequence number is smaller than the largest SACK sequence number previously received. state.reord is the smallest fack_count when disorder occurs, that is, disorder occurs at “snd_una + fack_count”. metric = tp -> fackets_out-state.reord, that is, the maximum number of packets that may be out of order. B. tcp_ack() -> tcp_clean_rtx_queue() -> tcp_update_reordering() is similar to A. tcp_clean_rtx_queue() calculates the hole in the data (non-retransmitted) that has been SACKed in the rtx queue, and the reord saves the position of the “smallest number” hole ( “Seats” in the retransmission queue). Prior_fackets-reord is the number of TCP segments that may be out of order. If there is no SACK, reorder = prior_fackets = 0 metric = prior_fackets - reord |
| TcpExt | TCPFACKReorder | Similar to TCPSACKReorder, if SACK and FACK are enabled at the same time, this counter is increased. |
| TcpExt | TCPTSReorder | tcp_ack() -> tcp_fastretrans_alrt() -> tcp_undo_partial() -> tcp_update_reordering() In the Recovery state, the number of times that a partial confirmation (snd_una <high_seq) has been received but the undo has been completed (undo_retrans == 0). The number is equal to TCPPartialUndo.r |
TCP Loss & Retrans
| category | name | description |
|---|---|---|
| Tcp | TCPTimeouts | In the RTO timer, the number of times from the first timeout in the CWR/Open state, the remaining states are not counted in this counter. The number of SYN-ACK timeouts. |
| Tcp | RtoAlgorithm | 1, tcp_mib_init() initialization |
| Tcp | RtoMax | 120000, tcp_mib_init() initialization: TCP_RTO_MAX1000/HZ, TCP_RTO_MAX=120HZ |
| Tcp | RtoMin | 200, tcp_mib_init() initialization: TCP_RTO_MIN*1000/HZ, TCP_RTO_MIN=HZ/5 |
| Tcp | RetransSegs | The number of retransmissions, including RTO timer and regular retransmissions, that is, tcp_transmit_skb() is called in tcp_retransmit_skb(), and the successful return is +1. |
| Tcp | TCPForwardRetrans | (Non-RTO timer) The number of times to send new data, that is, in tcp_fastretrans_alrt()/tcp_simple_retransmit()->tcp_xmit_retransmit_queue(), If it is found that skb->seq> tp->retransmit_high (usually snd_una), if the current state is Recovery, SACK is enabled, and the sending conditions allow, then send new data in this function. |
| Tcp | TCPFastRetrans | (Non-RTO timer) The number of fast retransmissions, ie tcp_fastretrans_alrt()/tcp_simple_retransmit()->tcp_xmit_retransmit_queue(), if it is not in the LOSS state, add 1 |
| Tcp | TCPSlowStartRetrans | (Non-RTO timer) retransmission times: ie tcp_fastretrans_alrt()/tcp_simple_retransmit()->tcp_xmit_retransmit_queue(), if it is in the state of LOSS, add 1 |
| Tcp | TCPLostRetransmit | Resegment packet loss counter inferred from SACK data: in tcp_sacktag_write_queue()->tcp_mark_lost_retrans(), if tcp_highest_sack_seq(tp) is found to exceed the snd_nxt(TCB->ack_seq) of a certain skb during retransmission, it is considered that this retransmitted packet If it has been lost, add 1 (not the number of segments). tcp_highest_sack_seq(tp) is the seq of the skb with the highest SEQ number that has been SACKed. |
| Tcp | TCPSpuriousRTOs | Resegment packet loss counter inferred from SACK data: in tcp_sacktag_write_queue()->tcp_mark_lost_retrans(), if tcp_highest_sack_seq(tp) is found to exceed the snd_nxt(TCB->ack_seq) of a certain skb during retransmission, it is considered that this retransmitted packet If it has been lost, add 1 (not the number of segments). tcp_highest_sack_seq(tp) is the seq of the skb with the highest SEQ number that has been SACKed. |
TCP Others
| category | name | description |
|---|---|---|
| TcpExt | TCPRenoRecoveryFail | “tcp_retransmit_timer(): RTO occurs in the Reovery state, and SACK is not enabled, add 1” |
| TcpExt | TCPRenoFailures | “tcp_retransmit_timer(): In the Reorder state, or when sacked_out is not 0, RTO occurs and SACK is not enabled, add 1” |
| TcpExt | TCPRenoRecovery | tcp_fastretrans_alrt(): The number of times that TCP without SACK enters the Reovery state |
| TcpExt | ArpFilter | “arp_rcv() -> NETFILTER(ARP_IN) -> arp_process()It has nothing to do with TCP. When an ARP packet is received, an output route search (sip, tip) is performed. If the device of the route item found is different from the input device, the counter is increased by 1” |
| TcpExt | EmbryonicRsts | tcp_v4_do_rcv() -> tcp_v4_hnd_req() -> tcp_check_req(): The number of RST or SYN received in the SYN_RECV state during the three-handed handshake. |
| TcpExt | LockDroppedIcmps | “tcp_v4_err(): ICMP error message is received, but the tcp socket is locked by the user” |
| TcpEx | OfoPruned | “tcp_data_queue() -> tcp_try_rmem_schedule()In the slow path, if the data cannot be copied directly to the user space, it needs to be added to the sk_receive_queue, and the receiver side memory is checked whether it is allowed. If the rcv_buf is insufficient, it may be prune ofo queue. At this time the counter is incremented by 1” |
| TcpExt | OutOfWindowIcmps | “tcp_v4_err(): ICMP received, but the number of times the TCP header sequence number in ICMP is not within the receiving window. There are two possible situations: (1) In the LISTEN state, the sequence number does not wait for ISN; (2) In other states, the sequence number Not between SND_UNA .. SND_NXT” |
| TcpExt | PAWSActive | “tcp_rcv_synsent_state_process(): After sending SYN, ACK is received, but the number of PAWS check failures.” |
| TcpExt | PAWSEstab | “tcp_validate_incoming()tcp_timewait_state_process()tcp_check_req() enters the number of PAWS failures in the package.” |
| TcpExt | PAWSPassive | tcp_v4_conn_request(): The number of PAWS check failures for the last ACK of the three-way handshake. |
| TcpExt | PruneCalled | “tcp_data_queue() -> tcp_try_rmem_schedule()In the slow path, if the data cannot be copied directly to the user space, it needs to be added to the sk_receive_queue, and the receiver side memory is checked whether it is allowed. If the rcv_buf is insufficient, it may be prune ofo queue. At this time the counter is incremented by 1” |
| TcpExt | RcvPruned | “tcp_data_queue() -> tcp_try_rmem_schedule()In the slow path, if the data cannot be copied directly to the user space, it needs to be added before sk_receive_queue, and the receiver side memory is checked whether it is allowed. If the rcv_buf is insufficient, the prune receive queue may be prune. If prune fails, this counter is increased by 1.” |
| TcpExt | SyncookiesFailed | cookie_v4_check(): SYN cookie check failed times. |
| TcpExt | SyncookiesRecv | cookie_v4_check(): The number of times of receiving SYN cookie. |
| TcpExt | SyncookiesSent | cookie_v4_init_sequence(): The number of times the SYN cookie is generated. |
| TcpExt | TCPAbortFailed | tcp_send_active_reset(): alloc_skb() or tcp_transmit_skb() failed. |
| TcpExt | TCPAbortOnClose | tcp_close(): The number of times there is still data in sk_receive_queue. |
| TcpExt | TCPAbortOnData | “tcp_rcv_state_process(): Receive subsequent data in the FIN_WAIT_1/FIN_WAIT_2 state (serial number> RCV_NXT); or, if the TCP_LINGER2 setting value is <0, the counter is incremented by 1tcp_close(): There is no unread data, but SO_LINGER is set and linger timeout=0, the counter is incremented by 1, and the TCP is normally disconnected sk_prot->disconnect()” |
| TcpExt | TCPAbortOnLinger | tcp_close(): The number of times that FIN_WAIT_2 immediately switches to CLOSE due to the TCP_LINGER2 setting value <0. |
| TcpExt | TCPAbortOnMemory | “When executing tcp_close()/probe timer/keepalive timer, whether the number of orphan sockets and tcp_memory_allocated exceed the maximum number of times.” |
| TcpExt | TCPAbortOnSyn | tcp_validate_incoming(): The number of occurrences of SYN and the sequence number is greater than RCV_NXT. |
| TcpExt | TCPAbortOnTimeout | RTO/probe/keepalive timer reaches the maximum number of retries or the maximum number of retries |
TCP TIME_WAIT
| category | name | description |
|---|---|---|
| TcpExt | TW | inet_twdr_do_twkill_work(): The number of sockets with TIME_WAIT timeout (timeout >= 4s). The reason why timewait sockets are treated as timeouts may be because the timeout time distribution of long timeout sockets is relatively scattered, and different search methods are required. |
| TcpExt | TWKilled | inet_twdr_twcal_tick(): TIME_WAIT timeout socket number. (timeout <4s), only when sysctl_tw_recycle is enabled, and TCP timestamp option is used, this will happen. At this time, 3.5x RTO is used as timewait timeout, and the default timeout is 60s |
| TcpExt | TWRecycled | tcp_v4_connect() -> __inet_check_established(): During establishment, if the port is reused from the TIME_WAIT socket, add 1 |
| TcpExt | TCPTimeWaitOverflow | tcp_time_wai(): When the system cannot allocate new tcp_timewait_socket, or tw_count (scheduled timewait sockets) exceeds sysctl_max_tw_buckets, add 1 |