I'm running netstat -s on my Ubuntu box at home to get network interface statistics. There are a bunch of numbers printed out, like this:

    10256 total packets received
    8 with invalid addresses
    0 forwarded
    0 incoming packets discarded
    10247 incoming packets delivered
    8918 requests sent out
    63 dropped because of missing route
    0 ICMP messages received
    0 input ICMP message failed.
    ICMP input histogram:
    55 ICMP messages sent
    0 ICMP messages failed
    ICMP output histogram:
        destination unreachable: 55
        OutType3: 55
    378 active connections openings
    0 passive connection openings
    5 failed connection attempts
    17 connection resets received
    30 connections established
    8478 segments received
    8223 segments send out
    26 segments retransmited
    0 bad segments received.
    33 resets sent
    911 packets received
    55 packets to unknown port received.
    0 packet receive errors
    893 packets sent
    85 TCP sockets finished time wait in fast timer
    182 delayed acks sent
    Quick ack mode was activated 11 times
    16 packets directly queued to recvmsg prequeue.
    22002 bytes directly received in process context from prequeue
    5397 packet headers predicted
    11 packets header predicted and directly queued to user
    922 acknowledgments not containing data payload received
    477 predicted acknowledgments
    2 congestion windows recovered without slow start by DSACK
    16 congestion windows recovered without slow start after partial ack
    24 other TCP timeouts
    11 DSACKs sent for old packets
    11 DSACKs received
    8 connections reset due to unexpected data
    7 connections reset due to early user close
    TCPDSACKIgnoredNoUndo: 1
    TCPSackShiftFallback: 18
    IPReversePathFilter: 1
    InMcastPkts: 65
    OutMcastPkts: 21
    InBcastPkts: 836
    InOctets: 8228049
    OutOctets: 1814741
    InMcastOctets: 13209
    OutMcastOctets: 4122
    InBcastOctets: 102775

Is there any way that I can determine the time period over which these statistics were collected?

1 Answer 1


Looking at the relevant source code of netstat or using strace -e open netstat -s, one can see that the above information is fetched from /proc/net/snmp and /proc/net/netstat. This proc-fs information is filled up by the Linux networking stack and initialised in net/ipv4/proc.c. This part of the kernel, if enabled, starts its functionality when the kernel boots up.

Since you have not specified the exactitude of the answer you're looking for, and to make a long story short, I suppose you might be happy enough with this:


You can also get it in seconds resolution using something along the lines of:

set -- $(grep btime /proc/stat) && btime = $2
bc -l < <(printf "%s - %s\n" "$(date +%s)" "$btime")

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .