stracing -v -eopen netstat -s shows that /proc/net/netstat is read. net-tools source shows reading is done with MIB item named TCPDirectCopyFromBacklog. /proc means kernel, so in LXR (http://lxr.linux.no/linux+v2.6.30/
) this is referenced in include/linux/snmp.h, net/ipv4/proc.c and net/ipv4/tcp.c. In the latter
, checking at aprox line 1470 where it reads "Ugly... If prequeue is not empty, we have to process it before releasing socket, otherwise order will be broken at second iteration", and if I understand this correctly, it reads that TCP backlog receive queue data does not need to be queued more but is processed directly, hence "TCP Direct Copy From Backlog".