Administering TCP/IP

Troubleshooting problems with netstat

The netstat(TC) program is helpful in tracking down network malfunctions. In particular, use the following options:

Flushing phantom connections

Use the netstat -a command to display active connections and sockets. Look for phantom connections -- those that still appear as active in the display that were terminated abnormally. If many appear, your network may run slowly, and you may need to stop and restart TCP/IP to flush the connections.

Troubleshooting packet errors

The netstat -i command displays active interfaces (network card and serial interfaces) as well as statistics on:

input packets per interface

input errors per interface

output packets per interface

output errors per interface

packet collisions detected
Here is a sample output:
   Name  Mtu    Network       Address     Ipkts  Ierrs Opkts   Oerrs Coll
   net0  1500   10.0.118      don         1348   12    1854    23    65
   lo0   8232   loopback      localhost   4058   0     4058    0     0
In using netstat -i, you should verify that the card is receiving and sending packets (that Ipkts and Opkts are nonzero), and that input and output errors as well as collisions are a small percentage of the packet total.

If both Ipkts and Ierrs are zero, the connection to the network may be bad, the network card may be bad, or there may be an interrupt vector conflict. Verify network cabling, then check for interrupt conflicts by running hwconfig or vectorsinuse. If a conflict exists, use the Network Configuration Manager to reconfigure your card. If the cable and interrupt vectors check out, run any diagnostic tools supplied by the manufacturer of the networking card.

If Ipkts is zero, but Ierrs is nonzero, the network, cabling, or card may be bad, another host on the network may be generating bad packets, or the network may be incorrectly terminated.

If Opkts is zero and Oerrs is nonzero, there may be a conflict of I/O addresses on the system. If both are zero, the conflict may be in shared memory addresses. Verify the I/O and shared memory addresses of each card on your system, and reconfigure your networking card with other supported addresses if conflicts exist.

If Coll is high (greater than 1-2 percent of the Opkts total), your network is very busy. Consider breaking the network into multiple separate networks.

Monitoring streams usage

Use the netstat -m command to monitor streams usage. The display shows each type of buffer allocated; the number free, allocated, and configured; the number of failures per type; and other streams information.

Streams are dynamically allocated in this release of TCP/IP, so streams errors should be uncommon. However, if you notice streams failures and need to reconfigure streams allocation, do so by using configure(ADM).

Verifying correct routing behavior

The netstat -r command provides information about the usage of each route configured on your system. A route consists of a destination host or network and a network interface used to exchange packets. Direct routes are created for each interface attached to the local host.

At a minimum, your routing table should display entries for the loopback mechanism (localhost), the local network, the local hostname, and the IP Multicasting route, 224. The following is a typical display:

   Routing tables
   Destination     Gateway         Flags     Refs     Use   Interface
   localhost       localhost       UH        24       66    lo0
   10.0.118        nile            UC        1        0     net0
   nile            localhost       UGHS      3        36    lo0
   224             nile            UCS       0        0     net0
The columns display:

Network or host to which this route allows you to connect.

Name of the gateway you configured for this route. If you are directly connected, this is a local address. Otherwise, it is the name of the host through which packets must be routed.

State of the route. For a complete list, refer to the manual page for route(ADMN). Common states are:

cloning -- new routes are derived from this route

a route to a gateway

a route to a host

a route to a network



Current number of active connections using the route. Connection-oriented protocols normally hold on to a single route for the duration of the connection, while connectionless protocols obtain a route, then discard it as needed.

Current number of packets sent using this route.

Name of the physical network interface to begin the route.
If one or more of these routes are missing, you may see routing errors when you try to contact other hosts. You can add routes manually by using the route add command. See route(ADMN) for more information.
Next topic: Logging troubleshooting information
Previous topic: Verifying remote network connectivity

© 2003 Caldera International, Inc. All rights reserved.
SCO OpenServer Release 5.0.7 -- 11 February 2003