Ubuntu Manpage: nicstat, enicstat - print network traffic statistics

NAME

       nicstat, enicstat - print network traffic statistics

SYNOPSIS

       nicstat [-hvnsxpztualkMU] [-iinterface] [-Sint:mbps[fd|hd]] [interval [count]]

       enicstat <same options & operands>

DESCRIPTION

       nicstat  prints  out  network  statistics for all network cards (NICs), including packets,
       kilobytes per second, average packet sizes and more.

OPTIONS

-h Display brief usage information (help).

-v Display nicstat version (and additional fields when combined with '-l')

-n Show statistics for non-local (i.e. non-loopback) interfaces only.

-s Display summary output - just the amount of data received (read) and transmitted
(written).

-x Display extended output. See OUTPUT section for details.

-U Display separate read and write utilization statistics. This affects the
default, extended (-x) and all (-a) format outputs. For the default format the
"Sat" statistic is dropped to fit the output in 80 columns.

-M Display interface throughput statistics in Mbps (megabits per second), instead
of the default KB/s (kilobytes per second).

NOTE - interface statistics are reported to operating systems in bytes. nicstat
does not know if Ethernet or other hardware overheads are included in the
statistic on each platform.

-p Display output in parseable format. This outputs one line per interface, in the
following formats (which correspond to the default, -x, -t and -u options;
respectively):

time:In:rKB/s:wKB/s:rPk/s:wPk/s:%Util:Sat
time:In:rKB/s:wKB/s:rPk/s:wPk/s:%Util:Sat:IErr:OErr:Coll:NoCP:Defer
time:TCP:InKB:OutKB:InSeg:OutSeg:Reset:AttF:%ReTX:InConn:OutCon:Drops
time:UDP:InDG:OutDG:InErr:OutErr

where time is the number of seconds since midnight, Jan 1 1970 (UST) and the
other fields are as described in the OUTPUT section below.

NOTE - throughput statistics are always in KB/s (kilbytes per second) for
parseable formats, even if the "-M" flag has been specified.

-z Skip interfaces for which there was zero traffic for the sample period.

-t Show TCP statistics.

-u Show UDP statistics.

-a Equvalent to '-x -t -u'.

-l Just list interfaces.

-iinterface[,interface...]
Show statistics for only the interface(s) listed. Multiple interfaces can be
listed, separated by commas (,).

-Sint:speed[fd|hd]
(Linux only). Specify the speed (and optionally duplex mode) of one or more
interfaces. The given speed(s) are in megabits/second. The duplex mode will
default to "full" unless a suffix beginning with "h" or "H" is specified. Speed
and duplex mode are obtained automatically on Solaris using the "ifspeed" and
"link_duplex" kstat values.

-k (Solaris only). Search for active network interfaces by looking for kstat
"link_state" statistics with a value of 1. This is only of value on systems
running Solaris 10 (or early releases of Solaris 11 Express), with Exclusive IP
Zones, where the interfaces given to an Exclusive IP Zone are not otherwise
visible. If you are running Solaris 9 (or earlier), or Solaris 11 (or later)
you do not need this option.

OPERANDS

       interval  Specifies the number of seconds between samples.

       count     Specifies the number of times that the statistics are repeated.  If no count  is
                 specified, nicstat will repeat statistics indefinitely.

OUTPUT

The fields of nicstat's display are:

Time The time corresponding to the end of the sample shown, in HH:MM:SS format
(24-hour clock).

Int The interface name.

rKB/s, InKB
Kilobytes/second read (received).

wKB/s, OutKB
Kilobytes/second written (transmitted).

rMbps, RdMbps
Megabits/second read (received).

wMbps, WrMbps
Megabits/second written (transmitted).

rPk/s, InSeg, InDG
Packets (TCP Segments, UDP Datagrams)/second read (received).

wPk/s, OutSeg, OutDG
Packets (TCP Segments, UDP Datagrams)/second written (transmitted).

rAvs Average size of packets read (received).

wAvs Average size of packets written (transmitted).

%Util Percentage utilization of the interface. For full-duplex interfaces, this is
the greater of rKB/s or wKB/s as a percentage of the interface speed. For half-
duplex interfaces, rKB/s and wKB/s are summed.

%rUtil, %wUtil
Percentage utilization for bytes read and written, respectively.

Sat Saturation. This the number of errors/second seen for the interface - an
indicator the interface may be approaching saturation. This statistic is
combined from a number of kernel statistics. It is recommended to use the '-x'
option to see more individual statistics (those mentioned below) when attempting
to diagnose a network issue.

IErr Packets received that could not be processed because they contained errors

OErr Packets that were not successfully transmitted because of errors

Coll Ethernet collisions during transmit.

NoCP No-can-puts. This is when an incoming packet can not be put to the process
reading the socket. This suggests the local process is unable to process
incoming packets in a timely manner.

Defer Defer Transmits. Packets without collisions where first transmit attempt was
delayed because the medium was busy.

Reset tcpEstabResets. The number of times TCP connections have made a direct
transition to the CLOSED state from either the ESTABLISHED state or the CLOSE-
WAIT state.

AttF tcpAttemptFails - The number of times that TCP connections have made a direct
transition to the CLOSED state from either the SYN-SENT state or the SYN-RCVD
state, plus the number of times TCP connections have made a direct transition to
the LISTEN state from the SYN-RCVD state.

%ReTX Percentage of TCP segments retransmitted - that is, the number of TCP segments
transmitted containing one or more previously transmitted octets.

InConn tcpPassiveOpens - The number of times that TCP connections have made a direct
transition to the SYN-RCVD state from the LISTEN state.

OutCon tcpActiveOpens - The number of times that TCP connections have made a direct
transition to the SYN-SENT state from the CLOSED state.

Drops tcpHalfOpenDrop + tcpListenDrop + tcpListenDropQ0.

tcpListenDrop and tcpListenDropQ0 - Number of connections dropped from the completed
connection queue and incomplete connection queue, respectively. tcpHalfOpenDrops - Number
of connections dropped after the initial SYN packet was received.

The first set of statistics printed are averages since system boot. If no interval
operand is specified, or a count value of "1" is specified, this will be the only sample
printed.

EXAMPLES

       Print average statistics from boot time to now only:

            $ nicstat

       Print statistics for all interfaces, every 3 seconds:

            $ nicstat 3

       Print statistics for all interfaces, every 5 seconds, finishing after 10 samples:

            $ nicstat 5 10

       Print statistics every 3 seconds, only for interfaces "hme0" and "hme1":

            $ nicstat -i hme0,hme1 3

       Print  statistics  for  non-local  interfaces,  setting  speed  of  "eth0"  and  "eth1" to
       10mbps/half-duplex and 1000mbps/full-duplex, respectively:

            $ nicstat -n -S eth0:10h,eth1:1000 5

NOTES

       On Linux, the NoCP, Defer, TCP InKB, and TCP OutKB statistics are always reported as zero.

       The  way  that saturation is reported is a best effort, as there is no standardized naming
       to capture all errors related to an interface's inability to receive or transmit a packet.
       Monitoring %Util and packet rates, along with an understanding of the specific NICs may be
       more useful in judging whether you are nearing saturation.

       The -S option is provided for the Linux edition as nicstat requires  super-user  privilege
       to  obtain  speed and duplex mode information for interfaces.  If you are unable to set up
       nicstat as setuid-root, a script named enicstat  is  available,  which  uses  the  ethtool
       utility then calls nicstat with an -S value.  ethtool itself requires super-user privilege
       for this to work.