When troubleshooting network issues on Linux systems, packet drops can manifest in several ways. Here's how to check basic statistics:

# Basic interface statistics
ifconfig eth0
netstat -i
ip -s link show eth0

The key fields to monitor are:

• RX packets (received)
• RX errors
• RX dropped
• RX overruns
• RX frame

For more granular details, examine the kernel's network statistics:

# All interface statistics
ls /sys/class/net/eth0/statistics/

# Detailed NIC-level stats
ethtool -S eth0

Common drop reasons you might find:

rx_missed_errors      # Packets missed by NIC
rx_fifo_errors        # FIFO overflows
rx_frame_errors       # Frame alignment errors
rx_no_buffer_count    # No kernel buffer available
rx_dropped            # General drop counter

The kernel maintains ring buffers that can overflow. Check current settings:

ethtool -g eth0

# Example output:
Ring parameters for eth0:
Pre-set maximums:
RX:     4096
RX Mini:    0
RX Jumbo:   0
TX:     4096
Current hardware settings:
RX:     256
RX Mini:    0
RX Jumbo:   0
TX:     256

You can adjust these values if needed:

ethtool -G eth0 rx 2048 tx 2048

Check CPU-level packet processing stats:

cat /proc/net/softnet_stat

Each line represents a CPU core, with columns showing:

1. Total packets processed
2. Dropped packets
3. Time squeeze events
4. CPU collision count

For real-time monitoring of packet drops:

# Install dropwatch
sudo apt install dropwatch

# Run in interactive mode
sudo dropwatch -l kas

Example output showing where drops occur:

1 drops at tcp_v4_do_rcv+cd
2 drops at unix_stream_connect+ab

Check protocol-specific drops:

# TCP stats
cat /proc/net/netstat | grep TcpExt

# IP stats
cat /proc/net/netstat | grep IpExt

Key TCP drop counters:

• TcpExtTCPBacklogDrop
• TcpExtPFMemallocDrop
• TcpExtTCPMemoryPressures

Here's a script to monitor drops across all interfaces:

#!/bin/bash

INTERFACES=$(ip -o link show | awk -F': ' '{print $2}')

while true; do
    clear
    date
    echo "=== Interface Statistics ==="
    for IF in $INTERFACES; do
        echo -n "$IF: "
        grep -H "" /sys/class/net/$IF/statistics/rx_dropped \
             /sys/class/net/$IF/statistics/tx_dropped 2>/dev/null
    done
    echo "=== Softnet Stats ==="
    cat /proc/net/softnet_stat | nl -v 0
    sleep 2
done

---

When diagnosing network interface issues on Linux systems, the rx_dropped counter is often the first red flag. But as shown in the sample statistics, multiple counters can reveal the underlying cause:

rx_dropped: 4738
rx_no_buffer_count: 0
rx_missed_errors: 0
rx_fifo_errors: 0

Combine these tools for comprehensive analysis:

# Interface statistics
ethtool -S eth0

# Kernel ring buffer parameters
ethtool -g eth0

# NIC driver information
ethtool -i eth0

# Real-time packet capture with drop monitoring
tcpdump -i eth0 -w capture.pcap &
cat /sys/class/net/eth0/statistics/rx_dropped

Case 1: Receiver Ring Buffer Overflows
When rx_missed_errors increases while rx_fifo_errors remains zero:

# Check current ring buffer settings
ethtool -g eth0

# Temporary increase (doesn't persist after reboot)
ethtool -G eth0 rx 4096

# Permanent solution - add to /etc/rc.local
echo "ethtool -G eth0 rx 4096" >> /etc/rc.local

Case 2: Multicast Filtering Drops
When rx_multicast counts packets but the interface isn't configured for multicast:

# Check multicast membership
netstat -gn

# Verify kernel multicast route cache
route -n | grep 224.0.0.0

# Disable unwanted multicast filtering
ifconfig eth0 -multicast

For complex cases where standard counters don't reveal the cause:

# Monitor softirq handling (watch for NET_RX drops)
watch -n 1 'cat /proc/softirqs | grep NET_RX'

# Check socket buffer allocation failures
grep "skbuff: kernel dropped" /var/log/messages

# Per-CPU drop statistics
cat /proc/net/softnet_stat | \
  awk '{printf "CPU %02d: total:%d drop:%d squeeze:%d\n", \
  NR-1, $1, $2, $3}'

Different NIC drivers expose unique counters. For Intel NICs:

# Display extended Intel statistics
ethtool --statistics eth0 | grep -i drop

# Common Intel-specific counters to monitor:
# - rx_drop_phy
# - rx_drop_no_fragments
# - rx_drop_over_mru

Create a periodic check for packet drops:

#!/bin/bash
INTERFACE=eth0
LOG_FILE=/var/log/network_drops.log

while true; do
  RX_DROPS=$(cat /sys/class/net/${INTERFACE}/statistics/rx_dropped)
  TX_DROPS=$(cat /sys/class/net/${INTERFACE}/statistics/tx_dropped)
  TIMESTAMP=$(date '+%Y-%m-%d %H:%M:%S')
  
  echo "${TIMESTAMP} - RX drops: ${RX_DROPS} | TX drops: ${TX_DROPS}" >> ${LOG_FILE}
  
  if [ ${RX_DROPS} -gt 0 ]; then
    echo "Packet drops detected! Running detailed diagnostics..." >> ${LOG_FILE}
    ethtool -S ${INTERFACE} >> ${LOG_FILE}
    cat /proc/net/softnet_stat >> ${LOG_FILE}
  fi
  
  sleep 60
done