Netstat

Network Analysis
The problem with netstat is there is a staggering amount of information available. Try netstat -s for
network statistics.
#netstat -s
RAWIP
rawipInDatagrams = 0 rawipInErrors = 0
rawipInCksumErrs = 0 rawipOutDatagrams = 0
rawipOutErrors = 0

UDP
udpInDatagrams =17227479 udpInErrors = 0
udpOutDatagrams =17210476 udpOutErrors = 0

TCP tcpRtoAlgorithm = 4 tcpRtoMin = 400

tcpRtoMax = 60000 tcpMaxConn = -1
tcpActiveOpens =121449 tcpPassiveOpens =123593
tcpAttemptFails = 1198 tcpEstabResets = 469
tcpCurrEstab = 89 tcpOutSegs =99321141
tcpOutDataSegs =94129579 tcpOutDataBytes =1737821124
tcpRetransSegs = 6771 tcpRetransBytes =4047173
tcpOutAck =5190950 tcpOutAckDelayed =2633452
tcpOutUrg = 134 tcpOutWinUpdate = 12831
tcpOutWinProbe = 26 tcpOutControl =491560
tcpOutRsts = 2614 tcpOutFastRetrans = 352
tcpInSegs =106046901
tcpInAckSegs =94153690 tcpInAckBytes =1737971355
tcpInDupAck =363643 tcpInAckUnsent = 0
tcpInInorderSegs =100156017 tcpInInorderBytes =278299936
tcpInUnorderSegs = 2077 tcpInUnorderBytes =2975624
tcpInDupSegs = 16862 tcpInDupBytes =1618160
tcpInPartDupSegs = 6 tcpInPartDupBytes = 3844
tcpInPastWinSegs = 8 tcpInPastWinBytes = 47840
tcpInWinProbe = 884 tcpInWinUpdate = 26
tcpInClosed = 20 tcpRttNoUpdate = 2988
tcpRttUpdate =93909335 tcpTimRetrans = 5873
tcpTimRetransDrop = 22 tcpTimKeepalive = 47189
tcpTimKeepaliveProbe= 15890 tcpTimKeepaliveDrop = 31
tcpListenDrop = 0 tcpListenDropQ0 = 0
tcpHalfOpenDrop = 0 tcpOutSackRetrans = 497

IPv4 ipForwarding = 2 ipDefaultTTL = 255

ipInReceives =101796067 ipInHdrErrors = 0
ipInAddrErrors = 0 ipInCksumErrs = 0
ipForwDatagrams = 0 ipForwProhibits = 0
ipInUnknownProtos = 0 ipInDiscards = 0
ipInDelivers =123153971 ipOutRequests =94246439
ipOutDiscards = 0 ipOutNoRoutes = 0
ipReasmTimeout = 60 ipReasmReqds = 0
ipReasmOKs = 0 ipReasmFails = 0
ipReasmDuplicates = 0 ipReasmPartDups = 0
 ipFragOKs = 0 ipFragFails = 0
ipFragCreates = 0 ipRoutingDiscards = 0
tcpInErrs = 1 udpNoPorts =1343350
udpInCksumErrs = 0 udpInOverflows = 80
rawipInOverflows = 0 ipsecInSucceeded = 0
ipsecInFailed = 0 ipInIPv6 = 0
ipOutIPv6 = 0 ipOutSwitchIPv6 = 3360

The statistics shown here are a small portion of first few screens of data! I am not an expert in all the
parameters, but a quick look at the error parameters such as tcpInErrs gives me an idea of the overall
health of the network.

You can also use netstat -a to examine for each port the number of bytes still waiting in the queue for
transmission and number of received bytes not copied to the application process by your server:
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0 *:netbios-ssn *:* LISTEN
tcp 0 0 *:webcache *:* LISTEN
tcp 0 0 *:x11 *:* LISTEN
tcp 0 0 *:http *:* LISTEN
tcp 0 0 *:ssh *:* LISTEN
tcp 0 0 S34KLJ142:smtp *:* LISTEN
tcp 0 0 *:https *:* LISTEN
tcp 0 0 200.7.1.142:netbios-ssn 200.7.1.26:1352 ESTABLISHED
tcp 0 0 200.7.1.142:33568 200.1.34.117:1521
tcp 0 180 200.7.1.142:ssh 200.7.1.25:1404 ESTABLISHED

Note that ssh still has 180 bytes of data to transmit in its queue. Not a problem, but this could be a
problem if the value is very large (meaning that the ssh data cannot be transmited fast enough, so it has
to be queued).
I also find it quite useful to use simple real-world benchmarks to analyze network performance, such as
the time required to transfer a 10 megabyte file (should be 10-15 seconds on a 10 Mbit network), or
using the apachebench ab -c1000 -n10 [url] command to simulate 10 clients sending a total of 1000
http requests to a server.

Network Response
$ netstat -i
Name Mtu Net/Dest Address Ipkts Ierrs Opkts Oerrs Collis Queue lo0 8232 loopback localhost 77814
0 77814 0 0 0 hme0 1500 server1 server1 10658566 3 4832511 0 279257 0 This option is used to
diagnose the network problems when  the connectivity is there but  it is slow in response .

Values to look at:

· Collisions (Collis)
 · Output packets (Opkts)
· Input errors (Ierrs)
· Input packets (Ipkts)
The above values will give information to workout
i.  Network collision rate as follows :
Network collision rate = Output collision counts / Output packets
 Network-wide collision rate greater than 10 percent  will indicate
·  Overloaded network,
·  Poorly configured network,
·  Hardware problems. 
ii.  Input packet error rate as follows :
 Input Packet Error Rate = Ierrs / Ipkts.
If the input error rate is high (over 0.25 percent), the host is dropping packets. Hub/switch cables etc
needs to be checked for potential problems.
C. Network socket &  TCP Cconnection state

Netstat gives important   information about network socket and tcp state . This is very useful in
finding out the open , closed and waiting network tcp connection .

Network states returned by  netstat are following :

     CLOSED               ----  Closed.  The socket  is  not  being used.
     LISTEN                 ----  Listening for incoming connections.
     SYN_SENT           ----  Actively trying to  establish  connection.
     SYN_RECEIVED  ---- Initial synchronization of the connection under way.
     ESTABLISHED     ----  Connection has been established.
     CLOSE_WAIT      ----  Remote shut down; waiting  for  the socket to close.
     FIN_WAIT_1        ----  Socket closed; shutting  down  connection.
     CLOSING             ----  Closed,   then   remote   shutdown; awaiting acknowledgement.
     LAST_ACK          ----   Remote  shut  down,  then   closed ;awaiting acknowledgement.
     FIN_WAIT_2        ----  Socket closed; waiting for shutdown from remote.
     TIME_WAIT         ----  Wait after close for  remote  shutdown retransmission.
     
 
Example:

 #netstat -a
 192.168.1.184.22192.168.1.183.58672180480246160ESTABLISHED
if  you see
192.168.1.184.22192.168.1.186.56806389120246160ESTABLISHED
a lots of

192.168.1.184.22192.168.1.186.50457419920246160ESTABLISHED

*.**.*00245760IDLE

*.32776*.*00245760LISTEN

*.32775*.*00245760LISTEN

*.32772*.*00245760LISTEN

*.898*.*00245760LISTEN

*.5987*.*00245760LISTEN

*.25*.*00245760LISTEN

*.4045*.*00245760LISTEN

*.32771*.*00245760LISTEN

*.**.*00245760IDLE

*.22*.*00245760LISTEN

*.22*.*00245760LISTEN

*.**.*00245760IDLE

Local AddressRemote AddressSwind   Send-QRwind Recv-QState 

 
connections in FIN_WAIT state  tcp/ip parameters   have to be tuned  because the

connections  are not being closed and they gets accumulating . After some time system may run out of
resource . TCP parameter can be tuned to define a time out so that connections can be released and
used by new connection.