Quickly inspect per-interface packet and byte counters to spot errors, drops and traffic trends with a single command. 23.12.2025 | reading time: 3 min The command "ip -s link" shows layer‑2 interface counters so a technician can detect errors, drops and byte volumes without packet captures; it is the fast first step in network troubleshooting and capacity checks. A real test on a Linux host Run the command and read the RX/TX blocks to understand what is happening on the wire: ```\nip -s link show eth0\n2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP mode DEFAULT group default qlen 1000\n link/ether 52:54:00:12:34:56 brd ff:ff:ff:ff:ff:ff\n RX: bytes packets errors dropped fifo frame compressed multicast\n 123456789 12345 0 12 0 1 0 123\n TX: bytes packets errors dropped fifo colls carrier compressed\n 98765432 9876 0 0 0 0 0 0\n``` In this example he sees twelve RX drops and one RX frame error; bytes and packet counts give immediate throughput context. Interpretation and quick moves Look at the RX and TX header lines to find the columns for errors and dropped; if errors increase, suspect link or driver problems; if drops climb, check queues and offload settings; repeat the command or run "watch -n1 ip -s link" to observe trends, and target a single device with "ip -s link show dev eth0" when investigating one interface. Options and deeper checks Add a second "-s" for more verbosity and driver counters with "ip -s -s link" to reveal additional statistics; combine the output with "grep" or short scripts to alert on nonzero errors; remember that "ip -s link" reports counters maintained by the kernel and does not show packet payloads or per-connection flows. When to capture packets Use "ip -s link" to decide whether a packet capture is warranted: if counters show increasing errors or drops, start a targeted "tcpdump" capture on that interface to see offending traffic; if counters are clean but you need per-socket insights, move to connection tools. Keep learning practical tools Combine interface counters with low‑level link diagnostics like "ethtool" and connection summaries from "ss" to build a complete picture; practice interpreting counters on lab systems to turn raw numbers into concrete root causes and mitigation steps. Final note and next steps Mastering "ip -s link" is a small, powerful step toward confident Linux network troubleshooting; explore deeper capture and analysis, then consider formal certification such as CompTIA Linux+ or LPIC-1 and intensive exam preparation at bitsandbytes.academy to turn skills into credentials. Join Bits & Bytes Academy First class LINUX exam preparation. network utilities troubleshooting
