Diagnose dropped packets and buffer pressure with practical commands and direct examples. 26.12.2025 | reading time: 3 min Packets disappear for reasons you can measure; this guide shows how to inspect kernel and NIC buffers to find the cause rather than guess. A live troubleshooting scenario Suspect packet loss on a server; check link and socket counters first by running `ip -s link show eth0` and `ss -s` to see drops and memory pressure: ```ip -s link show eth0``` output: ```3: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qlen 1000 RX: bytes 123456789 packets 10000 errors 0 dropped 42 overruns 0 frame 0 TX: bytes 98765432 packets 9500 errors 0 dropped 0 overruns 0 carrier 0 collisions 0``` then ```ss -s``` output: ```Total: 200 (established 150, closed 20, orphaned 0, timewait 5) TCP: inuse 150 orphan 0 tw 5 alloc 170 mem 100``` and confirm NIC-side drops with `ethtool -S eth0`: ```ethtool -S eth0``` output: ```rx_missed 42 rx_errors 0 tx_errors 0```. What to measure and why Look at three layers: NIC rings (driver/NAPI), kernel socket buffers (sk_buff allocation and memory), and per-socket TCP buffers; inspect ring sizes with `ethtool -g`, kernel limits with `sysctl net.core.rmem_max` and `net.core.wmem_max`, and per-protocol settings with `sysctl net.ipv4.tcp_rmem` to see whether drops are due to small ring sizes, exhausted socket memory, or application read delays. Concrete commands to act on If you see drops, increase NIC ring or switch to XPS/RPS, tune `net.core.rmem_max` and `net.core.wmem_max`, and check application behavior with `ss -i` per connection; measure before and after making a change, and watch for regressions in CPU or latency when you change buffer sizes. Where these tools fit together Use `ethtool` for NIC hardware and ring counters, `ss` and `/proc/net` for kernel socket statistics, and packet captures with `tcpdump` to correlate observed drops with traffic patterns; combine metrics to decide whether the fix belongs at the driver, kernel tunable, or application layer. Next steps Start from counters, change one knob at a time, and measure results; mastering buffer analysis will make systematic troubleshooting faster and reduce guesswork, and further study toward CompTIA Linux+ or LPIC-1 will deepen the skills needed for production systems and exam success at bitsandbytes.academy. Join Bits & Bytes Academy First class LINUX exam preparation. network troubleshooting utilities
