oreilly.comSafari Books Online.Conferences.


Linux Network Administration

Exploring the /proc/net/ Directory


The /proc/ filesystem is a trick the Linux kernel uses to make certain internal information available to user-space processes. The kernel presents the information in virtual files in virtual directories. The files and directories of the /proc/ filesystems are virtual because the data is not actually stored on any sort of permanent storage like a hard disk; instead, the directories, files, and data within them are created dynamically in memory from raw kernel data whenever you attempt to read from them. A variety of network information and data is available in the /proc/net/ directory. In this column we'll take a look at some of the more useful files available in the /proc/net/ subdirectory and how you might use them in administration of your network.

Mounting the /proc/ filesystem

All Linux distributions automatically mount the /proc/ filesystem at boot time. It's not essential that this be done, but a number of programs rely on it, so it's wise.

To see if the /proc filesystem is mounted on your machine, use the mount command without any arguments. You should see output that looks something like this:

proc on /proc type proc (rw)

If not, you can mount the /proc/ filesystem manually using the command:

mount -t proc proc /proc

and put the following entry into your /etc/fstab file so it is mounted automatically next time you reboot your machine:

proc /proc proc defaults 0 0 

The /proc/net/ directory

When the /proc/ filesystem is mounted, you can treat it as though it were a real filesystem containing directories and files. If you move to the /proc/net/ directory and list the files it contains, you will see a list that looks somewhat like the following:

arp           ip_fwnames    route      udp
dev           ip_mr_cache   rpc/       unix
dev_mcast     ip_mr_vif     rt_cache  
dev_stat      netlink       snmp
igmp          netstat       sockstat
ip_fwchains   raw           tcp

The actual list of files will vary a little depending on what version kernel you are running and what networking options you've compiled into it.

Each of these files contains information about some aspect of Linux networking. To view the contents of any of these files, you can simply use the cat command. Other utilities such as more or less should work more or less equally well. If you closely inspect these files, you'll see that they're all listed as zero bytes in length in a directory listing; this confuses some programs, so keep this in mind if you strike problems.

Let's take a look at what is inside some of these useful virtual files.

Interface statistics

The /proc/net/dev file contains information about the configured network interfaces. To view it, type cat /proc/net/dev -- you can view sample output here.

If you repeat this command periodically while there is active traffic on your network, you will see some of the numbers changing to reflect the updated statistics collected by the device drivers.

If you examine the format of the file, you'll see that there is one line for each logical network interface known to the kernel. In each line you are given the interface name followed by two sets of nearly identical statistics, receive and transmit, for that interface. The meanings of each of the columns are:


The total number of bytes of data transmitted or received by the interface.


The total number of packets of data transmitted or received by the interface.


The total number of transmit or receive errors detected by the device driver.


The total number of packets dropped by the device driver.


The number of FIFO buffer errors.


The number of packet framing errors.


The number of collisions detected on the interface.


The number of compressed packets transmitted or received by the device driver. (This appears to be unused in the 2.2.15 kernel.)


The number of carrier losses detected by the device driver.


The number of multicast frames transmitted or received by the device driver.

Socket status

The kernel exports information about open network sockets. The relevant /proc/net/ files for IPv4 are: tcp, udp, and raw. All three files have identical syntax. The first line provides labels for each of the columns in the output. Each following line represents one open socket. Results from cat /proc/net/tcp are shown here.

The data presented in each output column is:


The number of the line in the output listing.


The local IP address and port number for the socket. The IP address is displayed as a little-endian four-byte hexadecimal number; that is, the least significant byte is listed first, so you'll need to reverse the order of the bytes to convert it to an IP address. The port number is a simple two-byte hexadecimal number.


The remote IP address and port number for the socket. Encoding is the same as for the local_address.


The socket status.


The size of the transmit and receive queues.


The tr field indicates whether a timer is active for this socket. A value of zero indicates the timer is not active. The tm->when field indicates the time remaining (in jiffies) before timeout occurs.




The ID of the user that owns the socket. This is the same ID found in the /etc/passwd file.




A cryptic-looking number that identifies the socket to the Linux virtual filesystem.

Pages: 1, 2

Next Pagearrow

Linux Online Certification

Linux/Unix System Administration Certificate Series
Linux/Unix System Administration Certificate Series — This course series targets both beginning and intermediate Linux/Unix users who want to acquire advanced system administration skills, and to back those skills up with a Certificate from the University of Illinois Office of Continuing Education.

Enroll today!

Linux Resources
  • Linux Online
  • The Linux FAQ
  • Linux Kernel Archives
  • Kernel Traffic

  • Sponsored by: