Bug 212317

Summary:	/proc/net/dev: reversed counter for network namespaces?
Product:	Networking	Reporter:	Steffen Nurpmeso (steffen)
Component:	Other	Assignee:	Stephen Hemminger (stephen)
Status:	NEW ---
Severity:	normal	CC:	steffen
Priority:	P1
Hardware:	All
OS:	Linux
Kernel Version:	5.10.23	Subsystem:
Regression:	No	Bisected commit-id:

Description Steffen Nurpmeso 2021-03-17 14:14:36 UTC

Hello.
Yesterday i extended my tmux status line to include all "network devices", and now i am looking at a line

  RF:W~B~ wlp1s0~158/16 wg0~6/2 browse~8/124

which are /proc/net/dev devices (less in-namespace stuff) with non-0 byte counts.
wlp1s0 is the sole connection to the internet, and browse is a network namespace that boxes graphical browser usage, and can only access the internet, no local services (but DNS).

As you can see it states it has send 124 MiB and receives 8 MiB, which i deem wrong, especially since the entire up/downstream bytes of wlp1s0 state something different.  Could it be the counts are reversed?

Thank you!!

Comment 1 Steffen Nurpmeso 2021-03-20 01:52:14 UTC

iptables say

 pkts bytes target     prot opt in     out     source               destination
 238K   20M f_m1       all  --  browse wlp1s0  0.0.0.0/0            0.0.0.0/0
 362K  441M f_m1       all  --  wlp1s0 browse  0.0.0.0/0            0.0.0.0/0

and /proc/net/dev says

Inter-|   Receive                                                |  Transmit
 face |bytes    packets errs drop fifo frame compressed multicast|bytes    packets errs drop fifo colls carrier compressed
browse: 23193776  241737    0    0    0     0          0         0 446802271  366264    0    0    0     0       0          0

So - really, or?  I am a bit confused.
A nice weekend i wish.