proc_pid_net(5)

💖 proc_pid_net — /proc/pid/net/, /proc/net/ 💖

okay bestie, sit down, grab a strawberry 🍓 — this is a file formats manual page, and it's literally all about where the kernel dumps its whole networking lore. no cap.

---

✨ NAME ✨

/proc/pid/net/, /proc/net/ — network layer information 💅

---

🌸 DESCRIPTION 🌸

💜 /proc/pid/net/ (since Linux 2.6.25)

okay so this one is giving "just look at the other one" energy — go read the description of /proc/net down below, that's the whole vibe. 🫶

💜 /proc/net/

bestie, this directory is stacked. it holds a whole collection of files and subdirectories full of info about the networking layer, and the files inside are ASCII structures, which means you can literally just cat(1) them. iconic. however — and this is the tea ☕ — the standard netstat(8) suite gives you much cleaner access to all of these files. so like, live your truth, but know that.

then network namespaces showed up (see network_namespaces(7)) and the whole network stack got virtualized, main character style. so since Linux 2.6.25, /proc/net is a 💫 symbolic link 💫 to the directory /proc/self/net, which contains the exact same files and directories listed right here. but plot twist: those files and directories now expose information for the network namespace that the process is a member of. slay.

---

🎀 /proc/net/arp

this file is an ASCII-readable dump of the kernel ARP table — the one used for address resolutions. it shows both dynamically learned and preprogrammed ARP entries, no gatekeeping. the format is:

    IP address     HW type   Flags     HW address          Mask   Device
    192.168.0.50   0x1       0x2       00:50:BF:25:68:F3   *      eth0
    192.168.0.250  0x1       0xc       00:00:00:00:00:00   *      eth0

so here's the field breakdown, because i'm not gonna leave you guessing:

• "IP address" — the IPv4 address of the machine 👑
• "HW type" — the hardware type of the address, straight from RFC 826
• the flags — the internal flags of the ARP structure, as defined in /usr/include/linux/if_arp.h
• "HW address" — the data link layer mapping for that IP address, if it is known

---

🦋 /proc/net/dev

the dev pseudo-file is where network device status information lives. it hands you the number of received and sent packets, the number of errors and collisions, and other basic statistics. ifconfig(8) uses all this to report device status. the format is:

Inter-|   Receive                                                |  Transmit
 face |bytes    packets errs drop fifo frame compressed multicast|bytes    packets errs drop fifo colls carrier compressed
    lo: 2776770   11307    0    0    0     0          0         0  2776770   11307    0    0    0     0       0          0
  eth0: 1215645    2751    0    0    0     0          0         0  1782404    4324    0    0    0   427       0          0
  ppp0: 1622270    5552    1    0    0     0          0         0   354130    5669    0    0    0     0       0          0
  tap0:    7714      81    0    0    0     0          0         0     7714      81    0    0    0     0       0          0

---

🌈 /proc/net/dev_mcast

this one is defined in /usr/src/linux/net/core/dev_mcast.c, and it's giving:

    indx interface_name  dmi_u dmi_g dmi_address
    2    eth0            1     0     01005e000001
    3    eth1            1     0     01005e000001
    4    eth2            1     0     01005e000001

---

⭐ /proc/net/igmp

Internet Group Management Protocol. it's defined in /usr/src/linux/net/core/igmp.c. periodt.

---

💀 /proc/net/rarp

same format as the arp file, fr fr — but this one holds the current reverse mapping database used to provide rarp(8) reverse address lookup services. > ⚠️ heads up bestie: if RARP is not configured into the kernel, this file will not be present. it's just not gonna be there. don't go looking. 😭

---

👑 /proc/net/raw

this holds a dump of the RAW socket table. and ngl, most of the info in here is not of use apart from debugging. the field tea:

• "sl" — the kernel hash slot for the socket
• "local_address" — the local address and protocol number pair
• "St" — the internal status of the socket
• "tx_queue" and "rx_queue" — the outgoing and incoming data queue, measured in terms of kernel memory usage
• "tr", "tm->when", and "rexmits" — these fields are not used by RAW
• "uid" — the effective UID of the creator of the socket

---

🧚 /proc/net/snmp

this file holds the ASCII data needed for the IP, ICMP, TCP, and UDP management information bases for an SNMP agent. lowkey essential.

---

💅 /proc/net/tcp

a dump of the TCP socket table, bestie. and again — much of the information here is not of use apart from debugging. here's what's what:

• "sl" — the kernel hash slot for the socket
• "local_address" — the local address and port number pair
• "rem_address" — the remote address and port number pair (if connected)
• "St" — the internal status of the socket
• "tx_queue" and "rx_queue" — the outgoing and incoming data queue, in terms of kernel memory usage
• "tr", "tm->when", and "rexmits" — these hold internal information of the kernel socket state and are useful only for debugging
• "uid" — the effective UID of the creator of the socket

---

🍓 /proc/net/udp

a dump of the UDP socket table. (you know the drill: much of the information is not of use apart from debugging 🙈)

• "sl" — the kernel hash slot for the socket
• "local_address" — the local address and port number pair
• "rem_address" — the remote address and port number pair (if connected)
• "St" — the internal status of the socket
• "tx_queue" and "rx_queue" — the outgoing and incoming data queue, in terms of kernel memory usage
• "tr", "tm->when", and "rexmits" — these fields are not used by UDP
• "uid" — the effective UID of the creator of the socket

the format is:

sl  local_address rem_address   st tx_queue rx_queue tr rexmits  tm->when uid
 1: 01642C89:0201 0C642C89:03FF 01 00000000:00000001 01:000071BA 00000000 0
 1: 00000000:0801 00000000:0000 0A 00000000:00000000 00:00000000 6F000100 0
 1: 00000000:0201 00000000:0000 0A 00000000:00000000 00:00000000 00000000 0

---

🎀 /proc/net/unix

this lists the UNIX domain sockets present within the system and their status. the format:

Num RefCount Protocol Flags    Type St Inode Path
 0: 00000002 00000000 00000000 0001 03    42
 1: 00000001 00000000 00010000 0001 01  1948 /dev/printer

and the fields, because i would never leave you hanging:

• Num: the kernel table slot number.
• RefCount: the number of users of the socket.
• Protocol: currently always 0.
• Flags: the internal kernel flags holding the status of the socket.
• Type: the socket type. for SOCK_STREAM sockets this is 0001; for SOCK_DGRAM sockets it's 0002; and for SOCK_SEQPACKET sockets it's 0005.
• St: the internal state of the socket.
• Inode: the inode number of the socket.
• Path: the bound pathname (if any) of the socket. sockets in the abstract namespace are included in the list, and are shown with a Path that commences with the character '@'.

---

🫶 /proc/net/netfilter/nfnetlink_queue

this file contains information about netfilter user-space queueing, if used. each line represents a queue, and — important — queues that have not been subscribed to by user space are not shown. like, they're shy. 🙈

       1   4207     0  2 65535     0     0        0  1
      (1)   (2)    (3)(4)  (5)    (6)   (7)      (8)

the fields in each line are:

• (1) the ID of the queue. this matches what is specified in the --queue-num or --queue-balance options to the iptables(8) NFQUEUE target. see iptables-extensions(8) for more information.
• (2) the netlink port ID subscribed to the queue.
• (3) the number of packets currently queued and waiting to be processed by the application.
• (4) the copy mode of the queue. it is either 1 (metadata only) or 2 (also copy payload data to user space).
• (5) copy range; that is, how many bytes of packet payload should be copied to user space at most.
• (6) queue dropped. the number of packets that had to be dropped by the kernel because too many packets are already waiting for user space to send back the mandatory accept/drop verdicts.
• (7) queue user dropped. the number of packets that were dropped within the netlink subsystem. such drops usually happen when the corresponding socket buffer is full; that is, user space is not able to read messages fast enough.
• (8) sequence number. every queued packet is associated with a (32-bit) monotonically increasing sequence number. this shows the ID of the most recent packet queued.

⚠️ the last number exists only for compatibility reasons and is always 1. it's not doing anything. it's just there. we respect it. 💀

---

🔥 SEE ALSO 🔥

• proc(5)

---

✨ and that's the whole page, bestie — served fresh from Linux man-pages 6.20, dated 2026-02-08. mwah, go read your /proc, you're doing amazing sweetie 💖🎀🦋