Network Interface Statistics Analysis

In this lesson, you will learn how to pinpoint network performance bottlenecks by interpreting low-level driver and kernel interface statistics.

When a network interface behaves poorly, the Linux kernel tracks events at the driver level that can reveal whether the problem lies within the physical link, the driver itself, or the interface’s queue management. You can access these granular statistics using the command ip -s link show <interface>.

Identifying Drops and Collisions

Within the output of ip -s link, you should look closely at the RX (Receive) and TX (Transmit) error counters. Understanding these specific flags helps distinguish between hardware issues and resource exhaustion:

• drop: These are packets discarded by the kernel or the driver. On the RX side, this often means the system is receiving traffic faster than it can process it, causing the ring buffer to overflow. On the TX side, it often points to a congested qdisc (queuing discipline) where the interface cannot keep up with outgoing demand.
• fifo: These errors occur when the internal hardware buffers are exhausted. If you see these, your hardware is effectively "dropping the ball" before the packet even reaches the kernel’s networking stack.
• colls (Collisions): While rare in modern full-duplex Ethernet environments, a non-zero collision count usually indicates a duplex mismatch (e.g., one side is set to half-duplex while the other is full) or a failing physical cable/switch port.

Practical Analysis

If you observe RX drops while your CPU usage is low, it suggests the bottleneck is likely at the hardware or driver level—perhaps an interrupt coalescing setting or a misconfigured NAPI budget. If you see TX drops under high load, you are likely hitting the limits of your defined queuing discipline, signaling a need for traffic shaping or queue tuning.

By correlating these stats with ifconfig or netstat -i, you can establish a baseline. A stable system should have zero collisions and near-zero drops over time.

Key Takeaway: Monitoring drop and colls counters provides a clear diagnostic path to differentiate between physical layer issues, driver buffer exhaustion, and CPU-bound packet processing limits.