Documentation/networking/snmp_counter.rst

32 The number of packets delivers to the upper layer protocols. E.g. TCP, UDP,
249 General TCP counters
257 The number of packets received by the TCP layer. As mentioned in
259 error, invalid TCP header and so on. Only one error won't be included:
263 packets would be delivered to the TCP layer, but the TCP layer will discard
274 The number of packets sent by the TCP layer. As mentioned in RFC1213,
286 It means the TCP layer sends a SYN, and come into the SYN-SENT
296 It means the TCP layer receives a SYN, replies a SYN+ACK, come into
301 When packets are received by the TCP layer and are not be read by the
302 application, the TCP layer will try to merge them. This counter
309 When sending packets, the TCP layer will try to merge small packets to
322   more useful to track the TCP retransmission rate.
344 When kernel receives a SYN from a client, and if the TCP accept queue
347 TCP socket is in LISTEN state, and kernel need to drop a packet,
355 an old kernel, the TCP stack has different behavior when TCP accept
356 queue is full. On the old kernel, TCP stack won't drop the SYN, it
357 would complete the 3-way handshake. As the accept queue is full, TCP
358 stack will keep the socket in the TCP half-open queue. As it is in the
359 half open queue, TCP stack will send SYN+ACK on an exponential backoff
360 timer, after client replies ACK, TCP stack checks whether the accept
367 TCP Fast Open
392 When the TCP stack wants to retransmit a packet, and finds that packet
393 is not lost in the network, but the packet is not sent yet, the TCP
415 TCP Fast Path
417 When kernel receives a TCP packet, it has two paths to handler the
430   - Unexpected TCP flags/window values/header lengths are received
431     (detected by checking the TCP header against pred_flags)
435   - Unexpected TCP option.
442 directions. When the TCP window scale option is not used, kernel will
444 established state, but if the TCP window scale option is used, kernel
457 If a TCP packet has data (which means it is not a pure ACK packet),
462 TCP abort
466 It means TCP layer has data in flight, but need to close the
467 connection. So TCP layer sends a RST to the other side, indicate the
485 This counter means the application has unread data in the TCP layer when
486 the application wants to close the TCP connection. In such a situation,
487 kernel will send a RST to the other side of the TCP connection.
491 When an application closes a TCP connection, kernel still need to track
492 the connection, let it complete the TCP disconnect process. E.g. an
503 1. the memory used by the TCP protocol is higher than the third value of
504 the tcp_mem. Please refer the tcp_mem section in the `TCP man page`_:
513 This counter will increase when any of the TCP timers expire. In such
518 When a TCP connection comes into FIN_WAIT_2 state, instead of waiting
521 Linux kernel TCP stack. By configuring the TCP_LINGER2 socket option,
526 The kernel TCP layer will send RST if the `RFC2525 2.17 section`_ is
532 TCP Hybrid Slow Start
535 TCP congestion window Slow Start algorithm. It uses two pieces of
536 information to detect whether the max bandwidth of the TCP path is
568 TCP retransmission and congestion control
570 The TCP protocol has two retransmission mechanisms: SACK and fast
572 the kernel TCP stack would use SACK, or kernel would use fast
573 recovery. The SACK is a TCP option, which is defined in `RFC2018`_,
577 The TCP congestion control is a big and complex topic. To understand
591 TcpExtTCPRenoRecovery increases 1. These two counters mean the TCP
600 unusual, it is allowed by the TCP protocol. The sender doesn't really
635 packet yet, the sender would know packet 4 is out of order. The TCP
641 The TCP stack wants to retransmit a packet and the congestion control
646 The TCP stack wants to retransmit a packet and the congestion control
655 The TCP stack tries to deliver a retransmission packet to lower layers
660 The TCP stack retransmits a SYN packet.
667 duplicate. (2) an out of order packet is duplicate. The TCP stack
675 The TCP stack receives a duplicate packet which has been acked, so it
680 The TCP stack receives an out of order duplicate packet, so it sends a
685 The TCP stack receives a DSACK, which indicates an acknowledged
690 The TCP stack receives a DSACK, which indicate an out of order
710 SACK block is caused by ACK recording, the TCP stack will only ignore
717 of the TCP socket. If the undo_marker is not set, the TCP stack isn't
727 short). If a SACK block acrosses multiple skb, the TCP stack will try
745 A skb should be shifted or merged, but the TCP stack doesn't do it for
748 TCP out of order
752 The TCP layer receives an out of order packet and has enough memory
757 The TCP layer receives an out of order packet but doesn't have enough
767 TCP PAWS
770 which is used to drop old packets. It depends on the TCP
785 TCP ACK skip
800 TCP stack receives a SYN and replies SYN+ACK. Now the TCP stack is
801 waiting for an ACK. Generally, the TCP stack doesn't need to send ACK
802 in the Syn-Recv status. But in several scenarios, the TCP stack need
803 to send an ACK. E.g., the TCP stack receives the same SYN packet
806 the TCP stack needs to send ACK. If the ACk sending frequency is higher than
807 tcp_invalid_ratelimit allows, the TCP stack will skip sending ACK and
823 check and the TCP status is not Syn-Recv, Fin-Wait-2, and Time-Wait.
840 three scenarios, In some TCP status, the linux TCP stack would also
848 TCP receive window
852 Depending on current memory usage, the TCP stack tries to set receive
854 value. For example, if the previous window size is 10, and the TCP
860 The TCP receive window is set to zero from a no-zero value.
864 The TCP receive window is set to no-zero value from zero.
869 The TCP Delayed ACK is a technique which is used for reducing the
877 A delayed ACK timer expires. The TCP stack will send a pure ACK packet
882 A delayed ACK timer expires, but the TCP stack can't send an ACK
884 TCP stack will send a pure ACK later (after the userspace program
885 unlock the socket). When the TCP stack sends the pure ACK later, the
886 TCP stack will also update TcpExtDelayedACKs and exit the delayed ACK
891 It will be updated when the TCP stack receives a packet which has been
898 TLP is an algorithm which is used to detect TCP packet loss. For more
911 TCP Fast Open description
913 TCP Fast Open is a technology which allows data transfer before the
914 3-way handshake complete. Please refer the `TCP Fast Open wiki`_ for a
921 When the TCP stack receives an ACK packet in the SYN-SENT status, and
922 the ACK packet acknowledges the data in the SYN packet, the TCP stack
928 This counter indicates that the TCP stack initiated a TCP Fast Open,
938 This counter indicates how many times the TCP stack accepts the fast
943 This counter indicates how many times the TCP stack rejects the fast
945 TCP stack finds an error during the socket creating process.
950 fastopenq->max_qlen, the TCP stack will reject the fast open request
951 and update this counter. When this counter is updated, the TCP stack
977 How many reply packets of the SYN cookies the TCP stack receives.
997 updates this counter, the TCP stack might send a challenge ACK and
1003 When a socket is under memory pressure, the TCP stack will try to
1011 The TCP stack tries to reclaim memory for a socket. After updates this
1012 counter, the TCP stack will try to collapse the out of order queue and
1013 the receiving queue. If the memory is still not enough, the TCP stack
1019 The TCP stack tries to discard packet on the out of order queue.
1120 TCP normal traffic
1211 TCP window scale option is not used, kernel will try to enable fast
1213 but if the TCP window scale option is used, kernel will disable the
1267 packet, and the TCP layer has acked this packet, but the application didn't
1350   TCP:   14 (estab 1, closed 0, orphaned 10, synrecv 0, timewait 0/0), ports 0
1356   TCP       14        13        1
1446 On the server, we run a program which listen on TCP port 9000, but
1501 the receiving queue. So the TCP layer merged the two packets, and we
1669 offload for the TCP checksum, so the checksum in the /tmp/syn.pcap
1736 window. The linux TCP stack would avoid to skip if the packet has