netstat -s problem

[j773303]

I've some question about the "packets sent" and "data packets" of netstat -s. Kindly see the below outputs.

Q1: Why "data packets" > "packets sent" ?
Q2: Is it possible reset the value of "packets sent" ?
Q3: What's the meaning of "packets sent" and "data packets" of column of netstat -s ?

=========================================
$netstat -s
tcp:
21296866 packets sent
1599873175 data packets (2938494408 bytes)
...
...
...

=========================================

Thanks,

[Steven E. Protter · Accepted solution]

Shalom,

That may depend on the OS. Linux netstat has clear statistics reset functions.

That does not appear so obvious in HP-UX 11.00

Options

-a show state of all sockets, including passive sockets
-f show statistics only for specified address family
-g show multicast information for network interfaces
-i show statistics for network interfaces
-I show statistics only for specified network interface
-M show multicast routing tables
-Ms show multicast routing statistics
-n display network addresses numerically
-p show statistics only for specified protocol
-r show routing tables
-rv show additional information for the routing table
-s show statistics for all protocols

SEP

[Peter Godron]

Hi,
answer to one of your questions:

Q2: No reset, unless you remove card from system and then re-eanble. A reboot is the quickest way.
http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=949081

[rick jones]

ftp://ftp.cup.hp.com/dist/networking/briefs/annotated_netstat.txt

the counters up through (?) 11iv2 are 32-bit. So, they can "wrap" - and some (particularly the byte counters, but even the packet counters) can wrap sooner than others.

There is no particular need to reset the counters, you can always take a snapshot of netstat -s statistics at either end of an interval of interest and run them through beforeafter:

ftp://ftp.cup.hp.com/dist/networking/tools