Catch packet loss without using ICMP in FreeBSD

Question

Is it possible somehow to detect packet loss without using ICMP protocol (ping; fping etc) to avoid generation of additional network traffic by using default utils like netstat etc?

Answer 1

Not sure if this holds true for FreeBSD, but on Linux, you could check for TCP retransmits, potentially as a percentage of overall packets seen in a given time frame.

On linux, this would look something like:

> cat /proc/net/tcp sl local_address rem_address st tx_queue rx_queue tr tm->when retrnsmt uid timeout inode
0: 00000000:0014 00000000:0000 09 00000000:00000000 00:00000000 00000000 0 0 30111 1 0000000000000000 100 0 0 10 0

See also this question for other ideas, and for a netstat-based answer: https://serverfault.com/questions/318909/how-passively-monitor-for-tcp-packet-loss-linux.

The answer you need is from JoelK: netstat -s | grep retransmitted

Answer 2

The answer by iwaseatenbyagrue is a good answer (I upvoted it), but it suffers from a simple defect, i.e. it returns global packet loss statistics, while ping (and mtr, a combined traceroute/ping tool) are local to communications: in other words, they will detail packet loss on a specific communication, not on the average of all communications you entertained in the past.

Wireshark, a common packet-analyzing tool available on all OSes, can help you establish packet loss on a per-connection basis. The basis of this is the fact that TCP packets (but not UDP packets) carry a sequential sequence number (though the number of the first packet is determined in a roundabout way to circumvent a certain class of attacks), which makes it possible to ask for a repeat send whenever a packet is dropped before reaching the intended destination.

To make this work in Wireshark, Statistics -> Conversation statistics, and select the conversation (= the remote host) for which you want to establish packet loss rate from the TCP tab. Then you will get the throughput (packets per second from remote to local and viceversa) immediately. If instead you want the rate of packet loss, when choosing the conversation add the following filter and tcp.analysis.lost_segment, and look at how many packets are dropped by checking, in the status bar, how many packets match the filter.

There must be a zillion online sources on how to do this, I found this Youtube video simple and clear, but really googling wireshark packet loss will bring up many pages with good advice.

Answer 3

You can use MTR program with -u option that use datagrams instead of ICMP ECHO or option -T that using TCP SYN packets.

If you don't want to generate any extra traffic and just want to get accumulated statistics about packets lost in a past then you can get statistics from FreeBSD OS, from columns marked as err by running:

netstat -idb -I <interface_name>

You will get something like this:

# netstat -idb -I em0
Name    Mtu Network       Address              Ipkts Ierrs     Ibytes    Opkts Oerrs     Obytes  Coll Drop
em0    1500 <Link#1>      00:11:22:33:44:55 110031161     0 2708056139 176396459     0  366893484     0    0
em0    1500 192.168.24.0  mxmail            107582221     - 1545164761 177078111     - 2870208791     -    -