tcp syn and accept queue charts and alarms (#4281)

* tcp syn and accept queue charts and alarms; fixes #3234

* tcp syn and accept queue converted to auto

* updated configs.signatures

* enable 1m_ipv4_tcp_accept_queue_drops alarm

* /proc/net/netstat refers to the whole networking stack

* updated configs.signatures

14 files changed, 439 insertions, 248 deletions

diff --git a/conf.d/health.d/tcp_listen.conf b/conf.d/health.d/tcp_listen.conf
index 1bbb8eed8f..552930ab7c 100644
--- a/conf.d/health.d/tcp_listen.conf
+++ b/conf.d/health.d/tcp_listen.conf
@@ -1,28 +1,82 @@
+#
+# There are two queues involved when incoming TCP connections are handled
+# (both at the kernel):
+#
+# SYN queue
+# The SYN queue tracks TCP handshakes until connections are fully established.
+# It overflows when too many incoming TCP connection requests hang in the
+# half-open state and the server is not configured to fall back to SYN cookies.
+# Overflows are usually caused by SYN flood DoS attacks (i.e. someone sends
+# lots of SYN packets and never completes the handshakes).
+#
+# Accept queue
+# The accept queue holds fully established TCP connections waiting to be handled
+# by the listening application. It overflows when the server application fails
+# to accept new connections at the rate they are coming in.
+#
+#
 # -----------------------------------------------------------------------------
-# tcp listen sockets issues
+# tcp accept queue (at the kernel)
 
-   alarm: 1m_ipv4_tcp_listen_overflows
-      on: ipv4.tcplistenissues
-      os: linux freebsd
+   alarm: 1m_tcp_accept_queue_overflows
+      on: ip.tcp_accept_queue
+      os: linux
    hosts: *
   lookup: sum -60s unaligned absolute of ListenOverflows
    units: overflows
    every: 10s
     crit: $this > 0
    delay: up 0 down 5m multiplier 1.5 max 1h
-    info: the number of TCP listen socket overflows during the last minute
+    info: the number of times the TCP accept queue of the kernel overflown, during the last minute
       to: sysadmin
 
-   alarm: 1m_ipv4_tcp_listen_drops
-      on: ipv4.tcplistenissues
+# THIS IS TOO GENERIC
+# CHECK: https://github.com/netdata/netdata/issues/3234#issuecomment-423935842
+   alarm: 1m_tcp_accept_queue_drops
+      on: ip.tcp_accept_queue
       os: linux
    hosts: *
   lookup: sum -60s unaligned absolute of ListenDrops
    units: drops
    every: 10s
+#    warn: $this > 0
+    crit: $this > (($status == $CRITICAL) ? (0) : (150))
+   delay: up 0 down 5m multiplier 1.5 max 1h
+    info: the number of times the TCP accept queue of the kernel dropped packets, during the last minute (includes bogus packets received)
+      to: sysadmin
+
+
+# -----------------------------------------------------------------------------
+# tcp SYN queue (at the kernel)
+
+# When the SYN queue is full, either TcpExtTCPReqQFullDoCookies or
+# TcpExtTCPReqQFullDrop is incremented, depending on whether SYN cookies are
+# enabled or not. In both cases this probably indicates a SYN flood attack,
+# so i guess a notification should be sent.
+
+   alarm: 1m_tcp_syn_queue_drops
+      on: ip.tcp_syn_queue
+      os: linux
+   hosts: *
+  lookup: sum -60s unaligned absolute of TCPReqQFullDrop
+   units: drops
+   every: 10s
+    warn: $this > 0
+    crit: $this > (($status == $CRITICAL) ? (0) : (60))
+   delay: up 0 down 5m multiplier 1.5 max 1h
+    info: the number of times the TCP SYN queue of the kernel was full and dropped packets, during the last minute
+      to: sysadmin
+
+   alarm: 1m_tcp_syn_queue_cookies
+      on: ip.tcp_syn_queue
+      os: linux
+   hosts: *
+  lookup: sum -60s unaligned absolute of TCPReqQFullDoCookies
+   units: cookies
+   every: 10s
     warn: $this > 0
     crit: $this > (($status == $CRITICAL) ? (0) : (60))
    delay: up 0 down 5m multiplier 1.5 max 1h
-    info: the number of TCP listen socket drops during the last minute (includes bogus packets received)
+    info: the number of times the TCP SYN queue of the kernel was full and sent SYN cookies, during the last minute
       to: sysadmin
 
diff --git a/configs.signatures b/configs.signatures
index 045fc3ad5b..3e546a953f 100644
--- a/configs.signatures
+++ b/configs.signatures
@@ -35,6 +35,7 @@ declare -A configs_signatures=(
   ['084ee72d64760f2641b0720e79c922f3']='health.d/cpu.conf'
   ['0856124b1eecf01681b4fdf4e21efb3f']='health.d/net.conf'
   ['0862e7cf3d32ef48795702c6aefd27e0']='python.d/fail2ban.conf'
+  ['08de9ae0765a4161abe24c09e47b3454']='python.d/go_expvar.conf'
   ['08ff5218f938fc48e09e718821169d14']='health.d/redis.conf'
   ['091572888425bc3b8b559c3c53367ec7']='apps_groups.conf'
   ['09225283977a6584f8063016091cc4f2']='health.d/tcp_resets.conf'
@@ -239,6 +240,7 @@ declare -A configs_signatures=(
   ['5050b5963599f13ad5dc0263fa39a906']='python.d/fail2ban.conf'
   ['508771d8e4611a058991a1bc11039dea']='health.d/disks.conf'
   ['5120492fa26be3749192607f62dc05f8']='health.d/mdstat.conf'
+  ['51cb420bffed106ad9a710d64ee9ef0b']='health.d/tcp_listen.conf'
   ['5271cf9fc0fd10915a9759add70f7d78']='health.d/swap.conf'
   ['5278ebbae19c60db600f0a119cb3664e']='python.d/apache.conf'
   ['52d230aff57850a5aacc4e0420fcd8f5']='python.d.conf'
@@ -318,6 +320,7 @@ declare -A configs_signatures=(
   ['6aa4507f86657383917a0407f2a9cc0d']='python.d.conf'
   ['6acad8ce5c33e642742825db0eb9bb56']='python.d/web_log.conf'
   ['6b39de5d85db45115db236347a6896d4']='health.d/named.conf'
+  ['6b598533309e08d71023e46801d45d7e']='apps_groups.conf'
   ['6bb278bd9e171c4cb5c0fe639231288b']='python.d/web_log.conf'
   ['6bf0de6e3b251b765b10a71d8c5c319d']='python.d/apache.conf'
   ['6c9f2f0abe49a6f1a69db052ebcef1bf']='python.d/elasticsearch.conf'
@@ -427,6 +430,7 @@ declare -A configs_signatures=(
   ['8f520e787d995943e61a777c826bddf7']='python.d/litespeed.conf'
   ['8f7b734ea0f89abf8acbb47c50234477']='health.d/web_log.conf'
   ['8fd472a854b0996327e8ed3562161182']='health_alarm_notify.conf'
+  ['8fd9796492424780932b128edc62c1a4']='health.d/tcp_listen.conf'
   ['919911d13901d60a7580f5dfd7fc87bb']='health.d/ram.conf'
   ['91c377e7d26a1120cfbbd488332f0398']='python.d/dns_query_time.conf'
   ['91c757ef6be3abdb86906d9dbb9c217a']='fping.conf'
@@ -553,6 +557,7 @@ declare -A configs_signatures=(
   ['b8969be5b3ceb4a99477937119bd4323']='python.d.conf'
   ['b8aff60806fb6829a4e72a824e655375']='health.d/beanstalkd.conf'
   ['b8b87574fd496a66ede884c5336493bd']='python.d/phpfpm.conf'
+  ['b8ca1449d142b7f1cd202d875d400882']='health.d/apcupsd.conf'
   ['b915126262d08aa9da81de539a58a3fb']='python.d/redis.conf'
   ['ba11ea2d2f632b2de4b1224bcdc54f07']='python.d/smartd_log.conf'
   ['bb51112d01ff20053196a57632df8962']='apps_groups.conf'
@@ -650,6 +655,7 @@ declare -A configs_signatures=(
   ['dc0d2b96378f290eec3fcf98b89ad824']='python.d/cpufreq.conf'
   ['dc9c2a66778623a759706c14c3d91983']='health.d/net.conf'
   ['dd220677c42c487549952048ee1f7750']='python.d/postgres.conf'
+  ['dd221c29dfb7c5586fc906748aa7c831']='health.d/tcp_listen.conf'
   ['dd7764507804a2296bfd091a58ad4ad7']='health.d/memcached.conf'
   ['dd8254ef74509a3e38cb2838e30f7e63']='health.d/disks.conf'
   ['ddda2bb1c88be03b637d3285406f7910']='health.d/named.conf'
diff --git a/src/appconfig.h b/src/appconfig.h
index c4638bad56..1b6568ec06 100644
--- a/src/appconfig.h
+++ b/src/appconfig.h
@@ -1,5 +1,7 @@
 // SPDX-License-Identifier: GPL-3.0+
 
+#include "common.h"
+
 #ifndef NETDATA_CONFIG_H
 #define NETDATA_CONFIG_H 1
 
@@ -31,7 +33,10 @@ extern struct config
 
 #define CONFIG_BOOLEAN_NO   0
 #define CONFIG_BOOLEAN_YES  1
+
+#ifndef CONFIG_BOOLEAN_AUTO
 #define CONFIG_BOOLEAN_AUTO 2
+#endif
 
 extern int appconfig_load(struct config *root, char *filename, int overwrite_used);
 
diff --git a/src/common.h b/src/common.h
index 4ba7f9f822..e48e3541e3 100644
--- a/src/common.h
+++ b/src/common.h
@@ -145,7 +145,8 @@
 // - for each FAMILY  +100
 // - for each CHART   +10
 
-#define NETDATA_CHART_PRIO_SYSTEM_IPV4             501
+#define NETDATA_CHART_PRIO_SYSTEM_IP               501
+#define NETDATA_CHART_PRIO_SYSTEM_IPV6             502
 
 // Memory Section - 1xxx
 #define NETDATA_CHART_PRIO_MEM_SYSTEM              1000
@@ -160,44 +161,59 @@
 #define NETDATA_CHART_PRIO_MEM_HW                  1500
 
 
-// IPv4
-
-#define NETDATA_CHART_PRIO_IPV4                    3000
-#define NETDATA_CHART_PRIO_IPV4_SOCKETS            3000
-#define NETDATA_CHART_PRIO_IPV4_PACKETS            3050
-#define NETDATA_CHART_PRIO_IPV4_ERRORS             3100
-
-#define NETDATA_CHART_PRIO_IPV4_ICMP               3150
-
-#define NETDATA_CHART_PRIO_IPV4_TCP                3200
-#define NETDATA_CHART_PRIO_IPV4_TCP_MEM            3290
+// IP
 
-#define NETDATA_CHART_PRIO_IPV4_UDP                3300
-#define NETDATA_CHART_PRIO_IPV4_UDP_MEM            3390
+#define NETDATA_CHART_PRIO_IP                      4000
+#define NETDATA_CHART_PRIO_IP_ERRORS               4100
+#define NETDATA_CHART_PRIO_IP_TCP                  4200
+#define NETDATA_CHART_PRIO_IP_TCP_MEM              4290
+#define NETDATA_CHART_PRIO_IP_BCAST                4500
+#define NETDATA_CHART_PRIO_IP_MCAST                4600
+#define NETDATA_CHART_PRIO_IP_ECN                  4700
 
-#define NETDATA_CHART_PRIO_IPV4_UDPLITE            3400
 
-#define NETDATA_CHART_PRIO_IPV4_RAW                3450
-
-#define NETDATA_CHART_PRIO_IPV4_FRAGMENTS          3460
-#define NETDATA_CHART_PRIO_IPV4_FRAGMENTS_MEM      3470
+// IPv4
 
-#define NETDATA_CHART_PRIO_IPV4_BCAST              3500
-#define NETDATA_CHART_PRIO_IPV4_MCAST              3600
-#define NETDATA_CHART_PRIO_IPV4_ECN                3700
+#define NETDATA_CHART_PRIO_IPV4                    5100
+#define NETDATA_CHART_PRIO_IPV4_SOCKETS            5100
+#define NETDATA_CHART_PRIO_IPV4_PACKETS            5130
+#define NETDATA_CHART_PRIO_IPV4_ERRORS             5150
+#define NETDATA_CHART_PRIO_IPV4_ICMP               5170
+#define NETDATA_CHART_PRIO_IPV4_TCP                5200
+#define NETDATA_CHART_PRIO_IPV4_TCP_MEM            5290
+#define NETDATA_CHART_PRIO_IPV4_UDP                5300
+#define NETDATA_CHART_PRIO_IPV4_UDP_MEM            5390
+#define NETDATA_CHART_PRIO_IPV4_UDPLITE            5400
+#define NETDATA_CHART_PRIO_IPV4_RAW                5450
+#define NETDATA_CHART_PRIO_IPV4_FRAGMENTS          5460
+#define NETDATA_CHART_PRIO_IPV4_FRAGMENTS_MEM      5470
 
 // IPv6
 
-#define NETDATA_CHART_PRIO_IPV6                    3500
+#define NETDATA_CHART_PRIO_IPV6                    6200
+#define NETDATA_CHART_PRIO_IPV6_PACKETS            6200
+#define NETDATA_CHART_PRIO_IPV6_ERRORS             6300
+#define NETDATA_CHART_PRIO_IPV6_FRAGMENTS          6400
+#define NETDATA_CHART_PRIO_IPV6_TCP                6500
+#define NETDATA_CHART_PRIO_IPV6_UDP                6600
+#define NETDATA_CHART_PRIO_IPV6_UDP_ERRORS         6610
+#define NETDATA_CHART_PRIO_IPV6_UDPLITE            6700
+#define NETDATA_CHART_PRIO_IPV6_UDPLITE_ERRORS     6710
+#define NETDATA_CHART_PRIO_IPV6_RAW                6800
+#define NETDATA_CHART_PRIO_IPV6_BCAST              6840
+#define NETDATA_CHART_PRIO_IPV6_MCAST              6850
+#define NETDATA_CHART_PRIO_IPV6_ICMP               6900
+
 
 // SCTP
 
-#define NETDATA_CHART_PRIO_SCTP                    3600
+#define NETDATA_CHART_PRIO_SCTP                    7000
+
 
 // Netfilter
 
-#define NETDATA_CHART_PRIO_NETFILTER               3700
-#define NETDATA_CHART_PRIO_SYNPROXY                3750
+#define NETDATA_CHART_PRIO_NETFILTER               8700
+#define NETDATA_CHART_PRIO_SYNPROXY                8750
 
 
 // ----------------------------------------------------------------------------
diff --git a/src/plugin_nfacct.c b/src/plugin_nfacct.c
index 9cdbaa347e..f00498fdc0 100644
--- a/src/plugin_nfacct.c
+++ b/src/plugin_nfacct.c
@@ -306,7 +306,7 @@ static void nfstat_send_metrics() {
                     , "connections/s"
                     , "nfacct"
                     , NULL
-                    , 3001
+                    , NETDATA_CHART_PRIO_NETFILTER + 1
                     , nfstat_root.update_every
                     , RRDSET_TYPE_LINE
             );
@@ -342,7 +342,7 @@ static void nfstat_send_metrics() {
                     , "changes/s"
                     , "nfacct"
                     , NULL
-                    , 3002
+                    , NETDATA_CHART_PRIO_NETFILTER + 2
                     , nfstat_root.update_every
                     , RRDSET_TYPE_LINE
             );
@@ -379,7 +379,7 @@ static void nfstat_send_metrics() {
                     , "searches/s"
                     , "nfacct"
                     , NULL
-                    , 3010
+                    , NETDATA_CHART_PRIO_NETFILTER + 10
                     , nfstat_root.update_every
                     , RRDSET_TYPE_LINE
             );
@@ -416,7 +416,7 @@ static void nfstat_send_metrics() {
                     , "events/s"
                     , "nfacct"
                     , NULL
-                    , 3005
+                    , NETDATA_CHART_PRIO_NETFILTER + 5
                     , nfstat_root.update_every
                     , RRDSET_TYPE_LINE
             );
@@ -455,7 +455,7 @@ static void nfstat_send_metrics() {
                     , "expectations/s"
                     , "nfacct"
                     , NULL
-                    , 3003
+                    , NETDATA_CHART_PRIO_NETFILTER + 3
                     , nfstat_root.update_every
                     , RRDSET_TYPE_LINE
             );
@@ -675,7 +675,7 @@ static void nfacct_send_metrics() {
                 , "packets/s"
                 , "nfacct"
                 , NULL
-                , 3206
+                , NETDATA_CHART_PRIO_NETFILTER + 206
                 , nfacct_root.update_every
                 , RRDSET_TYPE_STACKED
         );
@@ -718,7 +718,7 @@ static void nfacct_send_metrics() {
                 , "kilobytes/s"
                 , "nfacct"
                 , NULL
-                , 3207
+                , NETDATA_CHART_PRIO_NETFILTER + 207
                 , nfacct_root.update_every
                 , RRDSET_TYPE_STACKED
         );
diff --git a/src/plugin_proc.h b/src/plugin_proc.h
index 6f976b693b..27d6aa63db 100644
--- a/src/plugin_proc.h
+++ b/src/plugin_proc.h
@@ -37,7 +37,6 @@ extern int get_numa_node_count(void);
 
 // metrics that need to be shared among data collectors
 extern unsigned long long tcpext_TCPSynRetrans;
-extern unsigned long long tcpext_TCPReqQFullDrop;
 
 // netdev renames
 extern void netdev_rename_device_add(const char *host_device, const char *container_device, const char *container_name);
diff --git a/src/proc_net_netstat.c b/src/proc_net_netstat.c
index 965164a215..712e2a354e 100644
--- a/src/proc_net_netstat.c
+++ b/src/proc_net_netstat.c
@@ -2,8 +2,9 @@
 
 #include "common.h"
 
+#define RRD_TYPE_NET_NETSTAT "ip"
+
 unsigned long long tcpext_TCPSynRetrans = 0;
-unsigned long long tcpext_TCPReqQFullDrop = 0;
 
 static void parse_line_pair(procfile *ff, ARL_BASE *base, size_t header_line, size_t values_line) {
     size_t hwords = procfile_linewords(ff, header_line);
@@ -26,7 +27,7 @@ int do_proc_net_netstat(int update_every, usec_t dt) {
 
     static int do_bandwidth = -1, do_inerrors = -1, do_mcast = -1, do_bcast = -1, do_mcast_p = -1, do_bcast_p = -1, do_ecn = -1, \
         do_tcpext_reorder = -1, do_tcpext_syscookies = -1, do_tcpext_ofo = -1, do_tcpext_connaborts = -1, do_tcpext_memory = -1,
-        do_tcpext_listen = -1;
+        do_tcpext_syn_queue = -1, do_tcpext_accept_queue = -1;
 
     static uint32_t hash_ipext = 0, hash_tcpext = 0;
     static procfile *ff = NULL;
@@ -35,61 +36,61 @@ int do_proc_net_netstat(int update_every, usec_t dt) {
     static ARL_BASE *arl_ipext = NULL;
 
     // --------------------------------------------------------------------
-    // IPv4
+    // IP
 
-    // IPv4 bandwidth
+    // IP bandwidth
     static unsigned long long ipext_InOctets = 0;
     static unsigned long long ipext_OutOctets = 0;
 
-    // IPv4 input errors
+    // IP input errors
     static unsigned long long ipext_InNoRoutes = 0;
     static unsigned long long ipext_InTruncatedPkts = 0;
     static unsigned long long ipext_InCsumErrors = 0;
 
-    // IPv4 multicast bandwidth
+    // IP multicast bandwidth
     static unsigned long long ipext_InMcastOctets = 0;
     static unsigned long long ipext_OutMcastOctets = 0;
 
-    // IPv4 multicast packets
+    // IP multicast packets
     static unsigned long long ipext_InMcastPkts = 0;
     static unsigned long long ipext_OutMcastPkts = 0;
 
-    // IPv4 broadcast bandwidth
+    // IP broadcast bandwidth
     static unsigned long long ipext_InBcastOctets = 0;
     static unsigned long long ipext_OutBcastOctets = 0;
 
-    // IPv4 broadcast packets
+    // IP broadcast packets
     static unsigned long long ipext_InBcastPkts = 0;
     static unsigned long long ipext_OutBcastPkts = 0;
 
-    // IPv4 ECN
+    // IP ECN
     static unsigned long long ipext_InNoECTPkts = 0;
     static unsigned long long ipext_InECT1Pkts = 0;
     static unsigned long long ipext_InECT0Pkts = 0;
     static unsigned long long ipext_InCEPkts = 0;
 
     // --------------------------------------------------------------------
-    // IPv4 TCP
+    // IP TCP
 
-    // IPv4 TCP Reordering
+    // IP TCP Reordering
     static unsigned long long tcpext_TCPRenoReorder = 0;
     static unsigned long long tcpext_TCPFACKReorder = 0;
     static unsigned long long tcpext_TCPSACKReorder = 0;
     static unsigned long long tcpext_TCPTSReorder = 0;
 
-    // IPv4 TCP SYN Cookies
+    // IP TCP SYN Cookies
     static unsigned long long tcpext_SyncookiesSent = 0;
     static unsigned long long tcpext_SyncookiesRecv = 0;
     static unsigned long long tcpext_SyncookiesFailed = 0;
 
-    // IPv4 TCP Out Of Order Queue
+    // IP TCP Out Of Order Queue
     // http://www.spinics.net/lists/netdev/msg204696.html
     static unsigned long long tcpext_TCPOFOQueue = 0; // Number of packets queued in OFO queue
     static unsigned long long tcpext_TCPOFODrop = 0;  // Number of packets meant to be queued in OFO but dropped because socket rcvbuf limit hit.
     static unsigned long long tcpext_TCPOFOMerge = 0; // Number of packets in OFO that were merged with other packets.
     static unsigned long long tcpext_OfoPruned = 0;   // packets dropped from out-of-order queue because of socket buffer overrun
 
-    // IPv4 TCP connection resets
+    // IP TCP connection resets
     // https://github.com/ecki/net-tools/blob/bd8bceaed2311651710331a7f8990c3e31be9840/statistics.c
     static unsigned long long tcpext_TCPAbortOnData = 0;    // connections reset due to unexpected data
     static unsigned long long tcpext_TCPAbortOnClose = 0;   // connections reset due to early user close
@@ -102,10 +103,12 @@ int do_proc_net_netstat(int update_every, usec_t dt) {
     static unsigned long long tcpext_ListenOverflows = 0;   // times the listen queue of a socket overflowed
     static unsigned long long tcpext_ListenDrops = 0;       // SYNs to LISTEN sockets ignored
 
-    // IPv4 TCP memory pressures
+    // IP TCP memory pressures
     static unsigned long long tcpext_TCPMemoryPressures = 0;
 
-    // shared tcpext_TCPReqQFullDrop
+    static unsigned long long tcpext_TCPReqQFullDrop = 0;
+    static unsigned long long tcpext_TCPReqQFullDoCookies = 0;
+
     // shared: tcpext_TCPSynRetrans
 
 
@@ -126,13 +129,15 @@ int do_proc_net_netstat(int update_every, usec_t dt) {
         do_tcpext_ofo        = config_get_boolean_ondemand("plugin:proc:/proc/net/netstat", "TCP out-of-order queue", CONFIG_BOOLEAN_AUTO);
         do_tcpext_connaborts = config_get_boolean_ondemand("plugin:proc:/proc/net/netstat", "TCP connection aborts", CONFIG_BOOLEAN_AUTO);
         do_tcpext_memory     = config_get_boolean_ondemand("plugin:proc:/proc/net/netstat", "TCP memory pressures", CONFIG_BOOLEAN_AUTO);
-        do_tcpext_listen     = config_get_boolean_ondemand("plugin:proc:/proc/net/netstat", "TCP listen issues", CONFIG_BOOLEAN_AUTO);
+
+        do_tcpext_syn_queue    = config_get_boolean_ondemand("plugin:proc:/proc/net/netstat", "TCP SYN queue", CONFIG_BOOLEAN_AUTO);
+        do_tcpext_accept_queue = config_get_boolean_ondemand("plugin:proc:/proc/net/netstat", "TCP accept queue", CONFIG_BOOLEAN_AUTO);
 
         arl_ipext  = arl_create("netstat/ipext", NULL, 60);
         arl_tcpext = arl_create("netstat/tcpext", NULL, 60);
 
         // --------------------------------------------------------------------
-        // IPv4
+        // IP
 
         if(do_bandwidth != CONFIG_BOOLEAN_NO) {
             arl_expect(arl_ipext, "InOctets",  &ipext_InOctets);
@@ -173,7 +178,7 @@ int do_proc_net_netstat(int update_every, usec_t dt) {
         }
 
         // --------------------------------------------------------------------
-        // IPv4 TCP
+        // IP TCP
 
         if(do_tcpext_reorder != CONFIG_BOOLEAN_NO) {
             arl_expect(arl_tcpext, "TCPFACKReorder", &tcpext_TCPFACKReorder);
@@ -208,14 +213,18 @@ int do_proc_net_netstat(int update_every, usec_t dt) {
             arl_expect(arl_tcpext, "TCPMemoryPressures", &tcpext_TCPMemoryPressures);
         }
 
-        if(do_tcpext_listen != CONFIG_BOOLEAN_NO) {
+        if(do_tcpext_accept_queue != CONFIG_BOOLEAN_NO) {
             arl_expect(arl_tcpext, "ListenOverflows", &tcpext_ListenOverflows);
             arl_expect(arl_tcpext, "ListenDrops",     &tcpext_ListenDrops);
         }
 
+        if(do_tcpext_syn_queue != CONFIG_BOOLEAN_NO) {
+            arl_expect(arl_tcpext, "TCPReqQFullDrop",      &tcpext_TCPReqQFullDrop);
+            arl_expect(arl_tcpext, "TCPReqQFullDoCookies", &tcpext_TCPReqQFullDoCookies);
+        }
+
         // shared metrics
         arl_expect(arl_tcpext, "TCPSynRetrans", &tcpext_TCPSynRetrans);
-        arl_expect(arl_tcpext, "TCPReqQFullDrop", &tcpext_TCPReqQFullDrop);
     }
 
     if(unlikely(!ff)) {
@@ -253,111 +262,111 @@ int do_proc_net_netstat(int update_every, usec_t dt) {
 
             if(do_bandwidth == CONFIG_BOOLEAN_YES || (do_bandwidth == CONFIG_BOOLEAN_AUTO && (ipext_InOctets || ipext_OutOctets))) {
                 do_bandwidth = CONFIG_BOOLEAN_YES;
-                static RRDSET *st_system_ipv4 = NULL;
+                static RRDSET *st_system_ip = NULL;
                 static RRDDIM *rd_in = NULL, *rd_out = NULL;
 
-                if(unlikely(!st_system_ipv4)) {
-                    st_system_ipv4 = rrdset_create_localhost(
+                if(unlikely(!st_system_ip)) {
+                    st_system_ip = rrdset_create_localhost(
                             "system"
-                            , "ipv4"
+                            , RRD_TYPE_NET_NETSTAT
                             , NULL
                             , "network"
                             , NULL
-                            , "IPv4 Bandwidth"
+                            , "IP Bandwidth"
                             , "kilobits/s"
                             , "proc"
                             , "net/netstat"
-                            , NETDATA_CHART_PRIO_SYSTEM_IPV4
+                            , NETDATA_CHART_PRIO_SYSTEM_IP
                             , update_every
                             , RRDSET_TYPE_AREA
                     );
 
-                    rd_in  = rrddim_add(st_system_ipv4, "InOctets",  "received", 8, BITS_IN_A_KILOBIT, RRD_ALGORITHM_INCREMENTAL);
-                    rd_out = rrddim_add(st_system_ipv4, "OutOctets", "sent",    -8, BITS_IN_A_KILOBIT, RRD_ALGORITHM_INCREMENTAL);
+                    rd_in  = rrddim_add(st_system_ip, "InOctets",  "received", 8, BITS_IN_A_KILOBIT, RRD_ALGORITHM_INCREMENTAL);
+                    rd_out = rrddim_add(st_system_ip, "OutOctets", "sent",    -8, BITS_IN_A_KILOBIT, RRD_ALGORITHM_INCREMENTAL);
                 }
                 else
-                    rrdset_next(st_system_ipv4);
+                    rrdset_next(st_system_ip);
 
-                rrddim_set_by_pointer(st_system_ipv4, rd_in,  ipext_InOctets);
-                rrddim_set_by_pointer(st_system_ipv4, rd_out, ipext_OutOctets);
+                rrddim_set_by_pointer(st_system_ip, rd_in,  ipext_InOctets);
+                rrddim_set_by_pointer(st_system_ip, rd_out, ipext_OutOctets);
 
-                rrdset_done(st_system_ipv4);
+                rrdset_done(st_system_ip);
             }
 
             // --------------------------------------------------------------------
 
             if(do_inerrors == CONFIG_BOOLEAN_YES || (do_inerrors == CONFIG_BOOLEAN_AUTO && (ipext_InNoRoutes || ipext_InTruncatedPkts))) {
                 do_inerrors = CONFIG_BOOLEAN_YES;
-                static RRDSET *st_ipv4_inerrors = NULL;
+                static RRDSET *st_ip_inerrors = NULL;
                 static RRDDIM *rd_noroutes = NULL, *rd_truncated = NULL, *rd_checksum = NULL;
 
-                if(unlikely(!st_ipv4_inerrors)) {
-                    st_ipv4_inerrors = rrdset_create_localhost(
-                            "ipv4"
+                if(unlikely(!st_ip_inerrors)) {
+                    st_ip_inerrors = rrdset_create_localhost(
+                            RRD_TYPE_NET_NETSTAT
                             , "inerrors"
                             , NULL
                             , "errors"
                             , NULL
-                            , "IPv4 Input Errors"
+                            , "IP Input Errors"
                             , "packets/s"
                             , "proc"
                             , "net/netstat"
-                            , NETDATA_CHART_PRIO_IPV4_ERRORS
+                            , NETDATA_CHART_PRIO_IP_ERRORS
                             , update_every
                             , RRDSET_TYPE_LINE
                     );
 
-                    rrdset_flag_set(st_ipv4_inerrors, RRDSET_FLAG_DETAIL);
+                    rrdset_flag_set(st_ip_inerrors, RRDSET_FLAG_DETAIL);
 
-                    rd_noroutes  = rrddim_add(st_ipv4_inerrors, "InNoRoutes",      "noroutes",  1, 1, RRD_ALGORITHM_INCREMENTAL);
-                    rd_truncated = rrddim_add(st_ipv4_inerrors, "InTruncatedPkts", "truncated", 1, 1, RRD_ALGORITHM_INCREMENTAL);
-                    rd_checksum  = rrddim_add(st_ipv4_inerrors, "InCsumErrors",    "checksum",  1, 1, RRD_ALGORITHM_INCREMENTAL);
+                    rd_noroutes  = rrddim_add(st_ip_inerrors, "InNoRoutes",      "noroutes",  1, 1, RRD_ALGORITHM_INCREMENTAL);
+                    rd_truncated = rrddim_add(st_ip_inerrors, "InTruncatedPkts", "truncated", 1, 1, RRD_ALGORITHM_INCREMENTAL);
+                    rd_checksum  = rrddim_add(st_ip_inerrors, "InCsumErrors",    "checksum",  1, 1, RRD_ALGORITHM_INCREMENTAL);
                 }
                 else
-                    rrdset_next(st_ipv4_inerrors);
+                    rrdset_next(st_ip_inerrors);
 
-                rrddim_set_by_pointer(st_ipv4_inerrors, rd_noroutes,  ipext_InNoRoutes);
-                rrddim_set_by_pointer(st_ipv4_inerrors, rd_truncated, ipext_InTruncatedPkts);
-                rrddim_set_by_pointer(st_ipv4_inerrors, rd_checksum,  ipext_InCsumErrors);
+                rrddim_set_by_pointer(st_ip_inerrors, rd_noroutes,  ipext_InNoRoutes);
+                rrddim_set_by_pointer(st_ip_inerrors, rd_truncated, ipext_InTruncatedPkts);
+                rrddim_set_by_pointer(st_ip_inerrors, rd_checksum,  ipext_InCsumErrors);
 
-                rrdset_done(st_ipv4_inerrors);
+                rrdset_done(st_ip_inerrors);
             }
 
             // --------------------------------------------------------------------
 
             if(do_mcast == CONFIG_BOOLEAN_YES || (do_mcast == CONFIG_BOOLEAN_AUTO && (ipext_InMcastOctets || ipext_OutMcastOctets))) {
                 do_mcast = CONFIG_BOOLEAN_YES;
-                static RRDSET *st_ipv4_mcast = NULL;
+                static RRDSET *st_ip_mcast = NULL;
                 static RRDDIM *rd_in = NULL, *rd_out = NULL;
 
-                if(unlikely(!st_ipv4_mcast)) {
-                    st_ipv4_mcast = rrdset_create_localhost(
-                            "ipv4"
+                if(unlikely(!st_ip_mcast)) {
+                    st_ip_mcast = rrdset_create_localhost(
+                            RRD_TYPE_NET_NETSTAT
                             , "mcast"
                             , NULL
                             , "multicast"
                             , NULL
-                            , "IPv4 Multicast Bandwidth"
+                            , "IP Multicast Bandwidth"
                             , "kilobits/s"
                             , "proc"
                             , "net/netstat"
-                            , NETDATA_CHART_PRIO_IPV4_MCAST
+                            , NETDATA_CHART_PRIO_IP_MCAST
                             , update_every
                             , RRDSET_TYPE_AREA
                     );
 
-                    rrdset_flag_set(st_ipv4_mcast, RRDSET_FLAG_DETAIL);
+                    rrdset_flag_set(st_ip_mcast, RRDSET_FLAG_DETAIL);
 
-                    rd_in  = rrddim_add(st_ipv4_mcast, "InMcastOctets",  "received", 8, BITS_IN_A_KILOBIT, RRD_ALGORITHM_INCREMENTAL);
-                    rd_out = rrddim_add(st_ipv4_mcast, "OutMcastOctets", "sent",    -8, BITS_IN_A_KILOBIT, RRD_ALGORITHM_INCREMENTAL);
+                    rd_in  = rrddim_add(st_ip_mcast, "InMcastOctets",  "received", 8, BITS_IN_A_KILOBIT, RRD_ALGORITHM_INCREMENTAL);
+                    rd_out = rrddim_add(st_ip_mcast, "OutMcastOctets", "sent",    -8, BITS_IN_A_KILOBIT, RRD_ALGORITHM_INCREMENTAL);
                 }
                 else
-                    rrdset_next(st_ipv4_mcast);
+                    rrdset_next(st_ip_mcast);
 
-                rrddim_set_by_pointer(st_ipv4_mcast, rd_in,  ipext_InMcastOctets);
-                rrddim_set_by_pointer(st_ipv4_mcast, rd_out, ipext_OutMcastOctets);
+                rrddim_set_by_pointer(st_ip_mcast, rd_in,  ipext_InMcastOctets);
+                rrddim_set_by_pointer(st_ip_mcast, rd_out, ipext_OutMcastOctets);
 
-                rrdset_done(st_ipv4_mcast);
+                rrdset_done(st_ip_mcast);
             }
 
             // --------------------------------------------------------------------
@@ -365,37 +374,37 @@ int do_proc_net_netstat(int update_every, usec_t dt) {
             if(do_bcast == CONFIG_BOOLEAN_YES || (do_bcast == CONFIG_BOOLEAN_AUTO && (ipext_InBcastOctets || ipext_OutBcastOctets))) {
                 do_bcast = CONFIG_BOOLEAN_YES;
 
-                static RRDSET *st_ipv4_bcast = NULL;
+                static RRDSET *st_ip_bcast = NULL;
                 static RRDDIM *rd_in = NULL, *rd_out = NULL;
 
-                if(unlikely(!st_ipv4_bcast)) {
-                    st_ipv4_bcast = rrdset_create_localhost(
-                            "ipv4"
+                if(unlikely(!st_ip_bcast)) {
+                    st_ip_bcast = rrdset_create_localhost(
+                            RRD_TYPE_NET_NETSTAT
                             , "bcast"
                             , NULL
                             , "broadcast"
                             , NULL
-                            , "IPv4 Broadcast Bandwidth"
+                            , "IP Broadcast Bandwidth"
                             , "kilobits/s"
                             , "proc"
                             , "net/netstat"
-                            , NETDATA_CHART_PRIO_IPV4_BCAST
+                            , NETDATA_CHART_PRIO_IP_BCAST
                             , update_every
                             , RRDSET_TYPE_AREA
                     );
 
-                    rrdset_flag_set(st_ipv4_bcast, RRDSET_FLAG_DETAIL);
+                    rrdset_flag_set(st_ip_bcast, RRDSET_FLAG_DETAIL);
 
-                    rd_in  = rrddim_add(st_ipv4_bcast, "InBcastOctets",  "received", 8, BITS_IN_A_KILOBIT, RRD_ALGORITHM_INCREMENTAL);
-                    rd_out = rrddim_add(st_ipv4_bcast, "OutBcastOctets", "sent",    -8, BITS_IN_A_KILOBIT, RRD_ALGORITHM_INCREMENTAL);
+                    rd_in  = rrddim_add(st_ip_bcast, "InBcastOctets",  "received", 8, BITS_IN_A_KILOBIT, RRD_ALGORITHM_INCREMENTAL);
+                    rd_out = rrddim_add(st_ip_bcast, "OutBcastOctets", "sent",    -8, BITS_IN_A_KILOBIT, RRD_ALGORITHM_INCREMENTAL);
                 }
                 else
-                    rrdset_next(st_ipv4_bcast);
+                    rrdset_next(st_ip_bcast);
 
-                rrddim_set_by_pointer(st_ipv4_bcast, rd_in,  ipext_InBcastOctets);
-                rrddim_set_by_pointer(st_ipv4_bcast, rd_out, ipext_OutBcastOctets);
+                rrddim_set_by_pointer(st_ip_bcast, rd_in,  ipext_InBcastOctets);
+                rrddim_set_by_pointer(st_ip_bcast, rd_out, ipext_OutBcastOctets);
 
-                rrdset_done(st_ipv4_bcast);
+                rrdset_done(st_ip_bcast);
             }
 
             // --------------------------------------------------------------------
@@ -403,36 +412,36 @@ int do_proc_net_netstat(int update_every, usec_t dt) {
             if(do_mcast_p == CONFIG_BOOLEAN_YES || (do_mcast_p == CONFIG_BOOLEAN_AUTO && (ipext_InMcastPkts || ipext_OutMcastPkts))) {
                 do_mcast_p = CONFIG_BOOLEAN_YES;
 
-                static RRDSET *st_ipv4_mcastpkts = NULL;
+                static RRDSET *st_ip_mcastpkts = NULL;
                 static RRDDIM *rd_in = NULL, *rd_out = NULL;
 
-                if(unlikely(!st_ipv4_mcastpkts)) {
-                    st_ipv4_mcastpkts = rrdset_create_localhost(
-                            "ipv4"
+                if(unlikely(!st_ip_mcastpkts)) {
+                    st_ip_mcastpkts = rrdset_create_localhost(
+                            RRD_TYPE_NET_NETSTAT
                             , "mcastpkts"
                             , NULL
                             , "multicast"
                             , NULL
-                            , "IPv4 Multicast Packets"
+                            , "IP Multicast Packets"