From: tom@dtint.uucp (Thomas R. Kimpton)
Subject: netstat reporting errors
Organization: Digital Technology, International
Date: Thu, 3 Sep 92 22:27:59 GMT

The reason I'm checking with netstat is because of general
network slowdowns, "cold spots" (locations on the network
that have slow response when others have timely response),
and dropped connections to our database.

Here is what I get when I run "netstat 3":

    input   (le0)     output           input  (Total)    output
packets errs  packets errs  colls  packets errs  packets errs  colls
762576  27094 338335  3     1337   915470  27094 491229  3     1337
6       0     3       0     0      6       0     3       0     0
4       0     4       0     0      4       0     4       0     0
^C
TCSH:dtint:19:/usr/tom> uptime
  3:48pm  up 9 days,  5:27,  3 users,  load average: 0.89, 0.66, 0.50

This is a 3.5% error rate on input packets! And for half that many
output packets, I get 3 (!) errors.

I can sit there and watch errors come in every 20-30 seconds!
Needless to say this worries me.  Also, isn't 1337 collisions out
of line also?

The netstat manual says, under "BUGS": "The notion of errors is
ill-defined."  I'd say that's an understatement, as they don't
define what constitutes errors at all!

Here's the "netstat -s" output:

ip:
	427627 total packets received
	0 bad header checksums
	0 with size smaller than minimum
	0 with data size < data length
	0 with header length < data size
	0 with data length < header length
	0 fragments received
	0 fragments dropped (dup or out of space)
	0 fragments dropped after timeout
	0 packets forwarded
	0 packets not forwardable
	0 redirects sent
	0 ip input queue drops
icmp:
	7 calls to icmp_error
	0 errors not generated 'cuz old message too short
	0 errors not generated 'cuz old message was icmp
	Output histogram:
		echo reply: 7
		destination unreachable: 7
		address mask reply: 217
	0 messages with bad code fields
	0 messages < minimum length
	0 bad checksums
	0 messages with bad length
	Input histogram:
		destination unreachable: 90
		echo: 7
		address mask request: 217
	224 message responses generated
tcp:
	327686 packets sent
		200899 data packets (54133320 bytes)
		2311 data packets (1693689 bytes) retransmitted
		80303 ack-only packets (24800 delayed)
		7 URG only packets
		142 window probe packets
		3734 window update packets
		40292 control packets
	401908 packets received
		233873 acks (for 54538831 bytes)
		36313 duplicate acks
		0 acks for unsent data
		121270 packets (22488088 bytes) received in-sequence
		3378 completely duplicate packets (6567 bytes)
		0 packets with some dup. data (0 bytes duped)
		13440 out-of-order packets (360254 bytes)
		7 packets (5 bytes) of data after window
		5 window probes
		4684 window update packets
		5 packets received after close
		0 discarded for bad checksums
		0 discarded for bad header offset fields
		0 discarded because packet too short
	13140 connection requests
	13479 connection accepts
	26218 connections established (including accepts)
	26676 connections closed (including 185 drops)
	449 embryonic connections dropped
	232014 segments updated rtt (of 246951 attempts)
	3226 retransmit timeouts
		5 connections dropped by rexmit timeout
	140 persist timeouts
	11557 keepalive timeouts
		11046 keepalive probes sent
		354 connections dropped by keepalive
udp:
	0 incomplete headers
	0 bad data length fields
	0 bad checksums
	0 socket overflows

==========

Perusing this I can see things that would probably contribute
to the 27K of errors, but, I don't really have a feel for
what they mean, i.e. are duplicate packets counted as errors,
out of order packets? window update packets? embryonic
connections dropped?  retransmit timeouts?

I'd like to be able to turn this data into areas to look into
to alleviate the problem(s), or people/programs to point
fingers at so I can blame them :-).

We are using this Sun as a Sybase server AND UShare EtherTalk
AppleShare file server.  On the network we have numerous Mac's,
several PC's, a Novell fileserver, several LaserWriters with
EtherPrint interfaces, and 1-3 other Sun's (they come and
go for training purposes, setup, etc.).

Thanks!
-- 
---
Tom Kimpton                            tom@dtint.dtint.com
Digital Technology Int.                (801)226-2984	
500 W. 1200 South, Orem UT, 84057      FAX (801) 226-8438
Newsgroups: comp.sys.sun.admin