Is it possible somehow to detect packet loss without using ICMP protocol (ping; fping etc) to avoid generation of additional network traffic by using default utils like netstat etc?

  • Why the Linux tag? If you have 2 systems talking to each other, you may be able to do byte accounting between the IP addresses on each side and compare the number of packets sent to packets received. Don't know how you would do this in freebsd, but it can be done in Linux.
    – davidgo
    Mar 2, 2017 at 8:52

3 Answers 3


Not sure if this holds true for FreeBSD, but on Linux, you could check for TCP retransmits, potentially as a percentage of overall packets seen in a given time frame.

On linux, this would look something like:

> cat /proc/net/tcp sl local_address rem_address st tx_queue rx_queue tr tm->when retrnsmt uid timeout inode
0: 00000000:0014 00000000:0000 09 00000000:00000000 00:00000000 00000000 0 0 30111 1 0000000000000000 100 0 0 10 0

See also this question for other ideas, and for a netstat-based answer: https://serverfault.com/questions/318909/how-passively-monitor-for-tcp-packet-loss-linux.

The answer you need is from JoelK: netstat -s | grep retransmitted

  • 1
    I get lost somewhere... The question was - how to get statistics about lost packets without generation of extra traffic and it supposed to be the FreeBSD. netstat -s doesn't exist on this OS as well "friendly" opened to anybody Linux's process tree in /proc/*
    – Alex
    Mar 2, 2017 at 20:51
  • OK - I did not know that (as mentioned in the first line, I showed what works for linux, since I don't know enough about the BSDs). That said, according to this manpage at least, FreeBSD should support netstat -s Mar 3, 2017 at 15:12
  • Argh... I was eaten by argue...literally :) You're right, netstat -s is working solution on FreeBSD, but absents of directory /proc it is 100% true (if one didn't turn on Linux compatibility mode which isn't by default). +1 from me
    – Alex
    Mar 3, 2017 at 22:27

The answer by iwaseatenbyagrue is a good answer (I upvoted it), but it suffers from a simple defect, i.e. it returns global packet loss statistics, while ping (and mtr, a combined traceroute/ping tool) are local to communications: in other words, they will detail packet loss on a specific communication, not on the average of all communications you entertained in the past.

Wireshark, a common packet-analyzing tool available on all OSes, can help you establish packet loss on a per-connection basis. The basis of this is the fact that TCP packets (but not UDP packets) carry a sequential sequence number (though the number of the first packet is determined in a roundabout way to circumvent a certain class of attacks), which makes it possible to ask for a repeat send whenever a packet is dropped before reaching the intended destination.

To make this work in Wireshark, Statistics -> Conversation statistics, and select the conversation (= the remote host) for which you want to establish packet loss rate from the TCP tab. Then you will get the throughput (packets per second from remote to local and viceversa) immediately. If instead you want the rate of packet loss, when choosing the conversation add the following filter and tcp.analysis.lost_segment, and look at how many packets are dropped by checking, in the status bar, how many packets match the filter.

There must be a zillion online sources on how to do this, I found this Youtube video simple and clear, but really googling wireshark packet loss will bring up many pages with good advice.

  • Agree - thanks for pointing it out. @user54, you can capture a pcap wireshark can read using tcpdump -i INTERFACE -w $HOSTNAME.INTERFACE.pcap Mar 2, 2017 at 19:40
  • What the point to use 3rd party program if you can get statistics from OS with simple netstat "on the average of all communications you entertained in the past"?
    – Alex
    Mar 2, 2017 at 20:56

You can use MTR program with -u option that use datagrams instead of ICMP ECHO or option -T that using TCP SYN packets.

If you don't want to generate any extra traffic and just want to get accumulated statistics about packets lost in a past then you can get statistics from FreeBSD OS, from columns marked as err by running:

netstat -idb -I <interface_name>

You will get something like this:

# netstat -idb -I em0
Name    Mtu Network       Address              Ipkts Ierrs     Ibytes    Opkts Oerrs     Obytes  Coll Drop
em0    1500 <Link#1>      00:11:22:33:44:55 110031161     0 2708056139 176396459     0  366893484     0    0
em0    1500  mxmail            107582221     - 1545164761 177078111     - 2870208791     -    -
  • mtr is just like using ping... Mar 2, 2017 at 18:36
  • @MariusMatutiae Yes, but the question was, how to avoid ICMP and that what I suggest to use instead of it, by use UDP or TCP syn and MTR can do that to spot issue with particular connection while netstat solution answer exactly what OP asked - get statistics about packets loss without generation of any extra traffic and without any 3rd party programs, particularly using netstat.
    – Alex
    Mar 2, 2017 at 20:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .