That's not netstat -s, it's netstat -i. (Also you have wrapped the diffs which makes them hard to read.) The point of netstat -s is that there a vast number of counters in the system. On my netbsd-7 system there are 555.lines of output. Many of them are error counters that stay 0. With problems, it's common (but not universal) that some of these counters increase; in theory any error and any normal path should increment some counter. So the idea is to look for changes you don't understand. For interface counts, you have to know how this is supposed to work and to trace the increments across multiple interfaces, removing all other confusing traffic and injecting test traffic. This is indeed not easy.
Attachment:
signature.asc
Description: PGP signature