"cat /proc/net/dev" and "ip -s link" show different statistics. Which one is lying?
On a Squeeze machine, trust /proc/net/dev
. It's a more straightforward and reliable way of looking at the same data.
For the particular case of the dropped count, I can't explain the exact issue, but I can observe it on other Squeeze boxes. If I cared, I would report it as a bug to Debian (and suggest someone does and reports back here).
Both take the number from the tx_dropped
field of net_device_stats
. In /proc/net/dev
, the line is generated by dev_seq_printf_stats
from net/core/dev.c
.
ip
goes, as usual, through netlink, and more precisely for network device statistics, rtnetlink. The structure passed to userspace, rtnl_link_stats
.
The native structure uses unsigned long
s, rtnetlink
uses __u32
, an more or less implicit conversion is done in copy_rtnl_link_stats
.
It's pretty easy to catch the 32-bit version is being used from the beginning of the structure, rx_packets: whilst /proc/net/dev
shows 1258629839430, ip
shows 244248462, which corresponds roughly to the last 32 bits (plus a few more bytes between commands); same thing with the packet count.
Here's the number crunching for those 2 first fields:
% echo '1258629839430 % (2^32)'|bc; echo 244248462
204421702
244248462
% echo '12545003042 % (2^32)'|bc; echo 3955476484
3955068450
3955476484
Things got better around the introduction of IFLA_STATS64
:
- in the kernel (from commit 10708f37ae729baba9b67bd134c3720709d4ae62, available upstream in v2.6.35 and later)
- in iproute2 (from commit 8864ac9dc5bd5ce049280337deb21191673a02d0, available upstream in v2.6.33-36 and later).