.\" Copyright (C) 1994, 1995, Daniel Quinlan <quinlan@yggdrasil.com>
.\" Copyright (C) 2002-2008, 2017, Michael Kerrisk <mtk.manpages@gmail.com>
.\" Copyright (C) , Alan Cox <A.Cox@swansea.ac.uk>
.\" Copyright (C) 2023, Alejandro Colomar <alx@kernel.org>
.\"
.\" SPDX-License-Identifier: GPL-3.0-or-later
.\"
.TH proc_pid_net 5 2024-05-02 "Linux man-pages (unreleased)"
.SH NAME
/proc/pid/net/, /proc/net/ \- network layer information
.SH DESCRIPTION
.TP
.IR /proc/ pid /net/ " (since Linux 2.6.25)"
See the description of
.IR /proc/net .
.TP
.I /proc/net/
This directory contains various files and subdirectories containing
information about the networking layer.
The files contain ASCII structures and are,
therefore, readable with
.BR cat (1).
However, the standard
.BR netstat (8)
suite provides much cleaner access to these files.
.IP
With the advent of network namespaces,
various information relating to the network stack is virtualized (see
.BR network_namespaces (7)).
Thus, since Linux 2.6.25,
.\" commit e9720acd728a46cb40daa52c99a979f7c4ff195c
.I /proc/net
is a symbolic link to the directory
.IR /proc/self/net ,
which contains the same files and directories as listed below.
However, these files and directories now expose information
for the network namespace of which the process is a member.
.TP
.I /proc/net/arp
This holds an ASCII readable dump of the kernel ARP table used for
address resolutions.
It will show both dynamically learned and preprogrammed ARP entries.
The format is:
.IP
.in +4n
.EX
IP address     HW type   Flags     HW address          Mask   Device
192.168.0.50   0x1       0x2       00:50:BF:25:68:F3   *      eth0
192.168.0.250  0x1       0xc       00:00:00:00:00:00   *      eth0
.EE
.in
.IP
Here "IP address" is the IPv4 address of the machine and the "HW type"
is the hardware type of the address from RFC\ 826.
The flags are the internal
flags of the ARP structure (as defined in
.IR /usr/include/linux/if_arp.h )
and
the "HW address" is the data link layer mapping for that IP address if
it is known.
.TP
.I /proc/net/dev
The dev pseudo-file contains network device status information.
This gives
the number of received and sent packets, the number of errors and
collisions
and other basic statistics.
These are used by the
.BR ifconfig (8)
program to report device status.
The format is:
.IP
.EX
Inter\-|   Receive                                                |  Transmit
 face |bytes    packets errs drop fifo frame compressed multicast|bytes    packets errs drop fifo colls carrier compressed
    lo: 2776770   11307    0    0    0     0          0         0  2776770   11307    0    0    0     0       0          0
  eth0: 1215645    2751    0    0    0     0          0         0  1782404    4324    0    0    0   427       0          0
  ppp0: 1622270    5552    1    0    0     0          0         0   354130    5669    0    0    0     0       0          0
  tap0:    7714      81    0    0    0     0          0         0     7714      81    0    0    0     0       0          0
.EE
.\" .TP
.\" .I /proc/net/ipx
.\" No information.
.\" .TP
.\" .I /proc/net/ipx_route
.\" No information.
.TP
.I /proc/net/dev_mcast
Defined in
.IR /usr/src/linux/net/core/dev_mcast.c :
.IP
.in +4n
.EX
indx interface_name  dmi_u dmi_g dmi_address
2    eth0            1     0     01005e000001
3    eth1            1     0     01005e000001
4    eth2            1     0     01005e000001
.EE
.in
.TP
.I /proc/net/igmp
Internet Group Management Protocol.
Defined in
.IR /usr/src/linux/net/core/igmp.c .
.TP
.I /proc/net/rarp
This file uses the same format as the
.I arp
file and contains the current reverse mapping database used to provide
.BR rarp (8)
reverse address lookup services.
If RARP is not configured into the
kernel,
this file will not be present.
.TP
.I /proc/net/raw
Holds a dump of the RAW socket table.
Much of the information is not of
use
apart from debugging.
The "sl" value is the kernel hash slot for the
socket,
the "local_address" is the local address and protocol number pair.
\&"St" is
the internal status of the socket.
The "tx_queue" and "rx_queue" are the
outgoing and incoming data queue in terms of kernel memory usage.
The "tr", "tm\->when", and "rexmits" fields are not used by RAW.
The "uid"
field holds the effective UID of the creator of the socket.
.\" .TP
.\" .I /proc/net/route
.\" No information, but looks similar to
.\" .BR route (8).
.TP
.I /proc/net/snmp
This file holds the ASCII data needed for the IP, ICMP, TCP, and UDP
management
information bases for an SNMP agent.
.TP
.I /proc/net/tcp
Holds a dump of the TCP socket table.
Much of the information is not
of use apart from debugging.
The "sl" value is the kernel hash slot
for the socket, the "local_address" is the local address and port number pair.
The "rem_address" is the remote address and port number pair
(if connected).
\&"St" is the internal status of the socket.
The "tx_queue" and "rx_queue" are the
outgoing and incoming data queue in terms of kernel memory usage.
The "tr", "tm\->when", and "rexmits" fields hold internal information of
the kernel socket state and are useful only for debugging.
The "uid"
field holds the effective UID of the creator of the socket.
.TP
.I /proc/net/udp
Holds a dump of the UDP socket table.
Much of the information is not of
use apart from debugging.
The "sl" value is the kernel hash slot for the
socket, the "local_address" is the local address and port number pair.
The "rem_address" is the remote address and port number pair
(if connected).
"St" is the internal status of the socket.
The "tx_queue" and "rx_queue" are the outgoing and incoming data queue
in terms of kernel memory usage.
The "tr", "tm\->when", and "rexmits" fields
are not used by UDP.
The "uid"
field holds the effective UID of the creator of the socket.
The format is:
.IP
.EX
sl  local_address rem_address   st tx_queue rx_queue tr rexmits  tm\->when uid
 1: 01642C89:0201 0C642C89:03FF 01 00000000:00000001 01:000071BA 00000000 0
 1: 00000000:0801 00000000:0000 0A 00000000:00000000 00:00000000 6F000100 0
 1: 00000000:0201 00000000:0000 0A 00000000:00000000 00:00000000 00000000 0
.EE
.TP
.I /proc/net/unix
Lists the UNIX domain sockets present within the system and their
status.
The format is:
.IP
.EX
Num RefCount Protocol Flags    Type St Inode Path
 0: 00000002 00000000 00000000 0001 03    42
 1: 00000001 00000000 00010000 0001 01  1948 /dev/printer
.EE
.IP
The fields are as follows:
.RS
.TP 10
.IR Num :
the kernel table slot number.
.TP
.IR RefCount :
the number of users of the socket.
.TP
.IR Protocol :
currently always 0.
.TP
.IR Flags :
the internal kernel flags holding the status of the socket.
.TP
.IR Type :
the socket type.
For
.B SOCK_STREAM
sockets, this is 0001; for
.B SOCK_DGRAM
sockets, it is 0002; and for
.B SOCK_SEQPACKET
sockets, it is 0005.
.TP
.IR St :
the internal state of the socket.
.TP
.IR Inode :
the inode number of the socket.
.TP
.IR Path :
the bound pathname (if any) of the socket.
Sockets in the abstract namespace are included in the list,
and are shown with a
.I Path
that commences with the character '@'.
.RE
.TP
.I /proc/net/netfilter/nfnetlink_queue
This file contains information about netfilter user-space queueing, if used.
Each line represents a queue.
Queues that have not been subscribed to
by user space are not shown.
.IP
.in +4n
.EX
   1   4207     0  2 65535     0     0        0  1
  (1)   (2)    (3)(4)  (5)    (6)   (7)      (8)
.EE
.in
.IP
The fields in each line are:
.RS 7
.TP 5
(1)
The ID of the queue.
This matches what is specified in the
.B \-\-queue\-num
or
.B \-\-queue\-balance
options to the
.BR iptables (8)
NFQUEUE target.
See
.BR iptables\-extensions (8)
for more information.
.TP
(2)
The netlink port ID subscribed to the queue.
.TP
(3)
The number of packets currently queued and waiting to be processed by
the application.
.TP
(4)
The copy mode of the queue.
It is either 1 (metadata only) or 2
(also copy payload data to user space).
.TP
(5)
Copy range; that is, how many bytes of packet payload should be copied to
user space at most.
.TP
(6)
queue dropped.
Number of packets that had to be dropped by the kernel because
too many packets are already waiting for user space to send back the mandatory
accept/drop verdicts.
.TP
(7)
queue user dropped.
Number of packets that were dropped within the netlink
subsystem.
Such drops usually happen when the corresponding socket buffer is
full; that is, user space is not able to read messages fast enough.
.TP
(8)
sequence number.
Every queued packet is associated with a (32-bit)
monotonically increasing sequence number.
This shows the ID of the most recent packet queued.
.RE
.IP
The last number exists only for compatibility reasons and is always 1.
.SH SEE ALSO
.BR proc (5)