How to show interface statistics with ip link

Showing interface statistics with ip -s link show is useful when a Linux interface looks up but packets are still being dropped, delayed, or retried somewhere below the IP layer. The extra RX and TX counters expose whether the interface is simply carrying traffic or accumulating low-level faults that need a different troubleshooting path.

The ip -s link show output comes from the kernel's per-interface link statistics and adds RX and TX counter sections beneath the normal ip link show device summary. Those sections include bytes, packets, errors, drops, multicast traffic, and other link-layer counters, while repeating the -s flag expands the error breakdown further.

These counters are cumulative until the interface is recreated or the system is restarted, so the useful signal usually comes from comparing two samples rather than reacting to a single non-zero total. Virtual devices and different drivers can also expose slightly different behavior, but rapidly increasing errors, dropped, missed, or carrier counters are the strongest clue that the fault is below routing, firewall, or application layers.

Steps to show interface statistics with ip link:

Show the statistics for one interface.

$ ip -s link show dev eth0
11: eth0@if302: &lt;BROADCAST,MULTICAST,UP,LOWER_UP&gt; mtu 65535 qdisc noqueue state UP mode DEFAULT group default
##### snipped #####
    RX:  bytes packets errors dropped  missed   mcast
      41801767    2247      0       0       0       0
    TX:  bytes packets errors dropped carrier collsns
         60662     824      0       0       0       0

Replace eth0 with the target interface name; container or veth-backed links can show a peer suffix such as eth0@if302.

Drop the dev selector to inspect the counters for every interface on the host.

$ ip -s link show
1: lo: &lt;LOOPBACK,UP,LOWER_UP&gt; mtu 65536 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1000
##### snipped #####
11: eth0@if302: &lt;BROADCAST,MULTICAST,UP,LOWER_UP&gt; mtu 65535 qdisc noqueue state UP mode DEFAULT group default
##### snipped #####

This is useful when the faulty interface is not yet obvious or when several links need to be compared quickly.

Repeat the -s flag to expand the RX and TX error buckets.

$ ip -s -s link show dev eth0
11: eth0@if302: &lt;BROADCAST,MULTICAST,UP,LOWER_UP&gt; mtu 65535 qdisc noqueue state UP mode DEFAULT group default
##### snipped #####
    RX:  bytes packets errors dropped  missed   mcast
      41676062    2847      0       0       0       0
    RX errors:  length    crc   frame    fifo overrun
                     0      0       0       0       0
    TX:  bytes packets errors dropped carrier collsns
         77916    1089      0       0       0       0
    TX errors: aborted   fifo  window heartbt transns
                     0      0       0       0       2

The ip command accepts repeated -s flags, and each extra flag increases the amount of statistics shown.

Run the same command again after a short wait or after generating traffic on the interface.

Bytes and packets rising by themselves usually mean traffic is flowing, while rising errors, dropped, missed, or carrier counters indicate an active link-quality, queueing, or driver problem.
Use the detailed counter names to narrow the next troubleshooting step.

Increasing carrier or TX/RX error-bucket values usually point to the NIC, driver, or physical link, while clean link counters with broken connectivity usually shift the focus to IP addressing, routes, firewall rules, or upper-layer services.

Author: Mohd Shakir Zakaria
Mohd Shakir Zakaria is a cloud architect with deep roots in software development and open-source advocacy. Certified in AWS, Red Hat, VMware, ITIL, and Linux, he specializes in designing and managing robust cloud and on-premises infrastructures.