Information about netstat command information

[Arturo Perez del Galleg]

Hi all!
When I execute the following command, netstat -p tcp, the obtained output is:
tcp:
11852716 packets sent
8467437 data packets (1336607906 bytes)
135993 data packets (192423919 bytes) retransmitted
1341568 ack-only packets (1258181 delayed)
0 URG only packets
2 window probe packets
1848896 window update packets
59230 control packets
10949528 packets received
3353857 acks (for 464828604 bytes)
243800 duplicate acks
0 acks for unsent data
6346592 packets (3847178301 bytes) received in-sequence
5533 completely duplicate packets (6289451 bytes)
682 packets with some dup. data (11960 bytes duped)
22151 out-of-order packets (11430334 bytes)
510 packets (13664 bytes) of data after window
504 window probes
375593 window update packets
7 packets received after close
0 discarded for bad checksums
0 discarded for bad header offset fields
0 discarded because packet too short
24549 connection requests
19157 connection accepts
37800 connections established (including accepts)
92754 connections closed (including 390 drops)
5905 embryonic connections dropped
3898020 segments updated rtt (of 3944547 attempts)
10581 retransmit timeouts
0 connections dropped by rexmit timeout
1 persist timeout
2775 keepalive timeouts
326 keepalive probes sent
6 connections dropped by keepalive
My question is,
what is the sense of 'connections closed' and 'connections established' counters?
How it's possible that 'connections closed' counter is greather than 'connections established' counter?
TIA

[Mark Greene_1]

Given that both closed and dropped connections are higher than connection requests and accepts, it's even more curious.

The real mystery isn't with netstat, it's with the device drive for the NIC, as that is what is doing the counting. Netstat is just reporting the counts.

You can watch the traffic in real-time by doing netstat -I . You can also run the command you did via cron and route the output to a file with the time in the file name. Do it every 30 or 60 minutes or so. Then you can run diff on the files and see what the delta is for a given time period. If the numbers are consistently moving together in a relatively fixed ratio, I wouldn't worry about it.

However, if after a day or so of doing this you aren't able to see any pattern with either the actual numbers of errors generated in a given time period, or with the delta between the connects & drops vs. the requests and accepts, I'd give HP support a call and ask them to walk you through running diags on the NIC with lanadmin or whatever else they have up their sleeve.

If you have glance, you can also monitor the same stuff from there.

HTH
mark

[Arturo Perez del Galleg]

Thanks, Mark!
I am watching the traffic and the obtained data is in the attached file. You can see the evolution of the counters and the numbers are consistently moving together (you can see in the first graphic).
But, i don't understand how it has been produced.
TIA

[Ron Kinner · Accepted solution]

On my 11.0 I have:

121771 connection requests
145068 connection accepts
266839 connections established (including accepts)
299829 connections closed (including 33042 drops)
5125 embryonic connections dropped.

Connections requests + Connection accepts =connections established.

Connections Established + drops = Connections closed - existing connections. (existing connections = netstat -an |grep EST |wc -l )

I expect it's a patch issue. Either with netstat (PHNE 1734 is the latest for 11.0) or with the driver. I notice there are a lot of netstat issues with the different driver patches.

http://www2.itrc.hp.com/service/patch/search.do?pageContextName=hpux:::

swlist -l patch |grep 1734

will tell you if you have the latest netstat patch for 11.0. (I see we don't have 1734 so more likely the problem is in your driver.)

Ron

[Arturo Perez del Galleg]

Thanks, Ron!
But the patch is PHNE_17434.
Your help is very appreciated.

[Arturo Perez del Galleg]

Sorry, but...
When the correct patch is tested... it's present on machine! (the previous verification was with PHNE_1734 patch).
More entries?
TIA

[Ron Kinner]

Sorry if I lost a digit in transcription and led you astray.

When you go to the site I listed and search on netstat you get a long list of different patches. Not knowing what driver you currently use or even what version of HPUX you have I can't suggest any other patches.

Ron

[Arturo Perez del Galleg]

Hi, Ron!
I have reinstalled the patch PHNE_17434 and the system works well!
My problem is resolved.
A lot of thanks, Ron.

[rick jones]

Some things that might be useful in interpreting netstat output:

ftp://ftp.cup.hp.com/dist/networking/briefs/annotated_netstat.txt

ftp://ftp.cup.hp.com/dist/networking/tools/beforeafter