THIS DOCUMENT HAS BEEN SUPERSEDED BY http://yong321.freeshell.org/osnotes/netstat-s.html Please read that document instead. Network Statistics The well known command `netstat -s' shows network statistics for each of the major protocols. But the meanings of the statistics are not easy to find. Take "incoming packets delivered" in the IP protocol stats as an example. The word "incoming" suggests that this stat is a counter of inbound (ingress) packets. But the word "delivered" sounds like outbound (egress). The true meaning can be found in the source code for netstat, specifically the statistics part of it at e.g. https://github.com/ecki/net-tools/blob/master/statistics.c where, for "incoming packets delivered", we see {"InDelivers", N_("%llu incoming packets delivered"), number}, The word "InDelivers" can be found in the document SNMP MIB for IP protocol https://datatracker.ietf.org/doc/html/rfc2011 where we see "The total number of input datagrams successfully delivered to IP user-protocols (including ICMP)." as the description of "ipInDelivers". The question comes down to What is "IP user-protocols"? In https://datatracker.ietf.org/doc/html/rfc986 we see "The Current IP addresses and IP user protocol numbers can be found in [4]." where Reference [4] points to https://datatracker.ietf.org/doc/html/rfc960 and in there we can confirm that the so-called "IP user-protocols" are indeed upper layer, i.e. transport layer, protocols, such as TCP, UDP, ICMP, etc. In short, "incoming packets delivered" IP statistic is the counter for incoming IP packets that are delivered to the upper network layer. In most cases, there's no need to read that many documents to understand the meanings of IP layer stats. Just the source code statistics.c and the SNMP MIB for IP protocol document is enough. If the stat is for another layer, say TCP or UDP, this web page https://blog.packagecloud.io/monitoring-tuning-linux-networking-stack-sending-data/ can help. (The author says the explanations of the stats are in Linux source code.) A common question is How good or bad is the networking on a server? The most basic commands such as `ifconfig' or `ip -s a' can be run to see "errors" and "dropped" values. A meaningful judgment can be made by dividing these numbers by the total number of received (RX) or transmitted (TX) packets. The problem, though, is that these error or dropped numbers are normally very low. A better assessment can be made by checking protocol specific stats given by `netstat -s'. The following is from a server running Red Hat Enterprise Linux 8. Words after "<-" are my calculations of the error counts relative to total packets sent in the same direction (either inbound or outbound), or to packets processed successfully (e.g. "packets reassembled ok"). Ip: Forwarding: 2 7522922517 total packets received 0 forwarded 0 incoming packets discarded 5797033274 incoming packets delivered 5215103737 requests sent out 3810 outgoing packets dropped <- 3810/5215103737=.00000073 60 dropped because of missing route <- 60/5215103737=.00000001 272481 fragments dropped after timeout <- 272481/7522922517=.000036 2030052935 reassemblies required 304163692 packets reassembled ok 311741515 packet reassemblies failed <- 311741515/304163692=1.025 334447065 fragments received ok 75193 fragments failed <- 75193/334447065=.000225 2332099696 fragments created compared to another server: Ip: Forwarding: 2 6089061699 total packets received 30 with invalid addresses 0 forwarded 0 incoming packets discarded 4907436724 incoming packets delivered 3916960289 requests sent out 4 outgoing packets dropped <- 4/3916960289=.000000001 23 dropped because of missing route <- 23/3916960289=.000000006 324 fragments dropped after timeout <- 324/6089061699=.00000005 1566724730 reassemblies required 385099787 packets reassembled ok 615 packet reassemblies failed <- 615/385099787=.0000016 534572584 fragments received ok 2901349130 fragments created We can see that of the 4 common IP stats, all 4 metrics are worse on the first server than on the second. Note that when determining which stat should be used as the denominator in calculating the ratio, the most important is to identify the direction of packet transmission. For example, it's not clear whether "dropped because of missing route" is for inbound or outbound packets. From statistics.c, we see the variable for this description is OutNoRoutes, so we know it's a counter for outbound packets. If confirmation or more description is needed, we can consult the SNMP MIB document, where we read for this variable "The number of IP datagrams discarded because no route could be found to transmit them to their destination, ..." In terms of UDP stats, the two servers tie: the first server: Udp: 3661310826 packets received 2873 packets to unknown port received <- 2873/3661310826=.0000008 0 packet receive errors 3620677413 packets sent 0 receive buffer errors 3810 send buffer errors <- 3810/3620677413=.000001 vs. the second server: Udp: 1920208872 packets received 57955 packets to unknown port received <- 57955/1920208872=.00003 0 packet receive errors 1918073626 packets sent 0 receive buffer errors 4 send buffer errors <- 4/1918073626=.000000002 But I consider "send buffer errors" more serious than "packets to unknown port". In short, the meanings of the statistics are in https://github.com/ecki/net-tools/blob/master/statistics.c https://datatracker.ietf.org/doc/html/rfc2011 https://blog.packagecloud.io/monitoring-tuning-linux-networking-stack-sending-data/ My answer to "What does 'incoming packets delivered' mean?": https://unix.stackexchange.com/questions/249314/what-does-incoming-packets-delivered-mean-in-netstat-s-output-on-linux/753742