Using the nstat network statistics command in Linux
To continue the statistics theme of my writing over the last several weeks, I wanted to look at another powerful tool that we can use as Linux admins. You don't need to memorize every one of these tools. However, it is prudent to know each of the commands and have a basic understanding of them so you can choose the best command for your use case. Let's dive into nstat.
What is nstat?
The purpose of nstat is to pull network metrics from the kernel and display them to the user, focusing on SNMP.
Most command-line users are familiar with the netstat command from the net-tools package. The net-tools package was almost entirely deprecated in favor of the ip command suite, and you may have guessed that nstat belongs to the new package.
Although netstat has a more user-friendly output, the nstat command holds its own and even has a few modern tricks up its sleeve.
Syntax
The command syntax is as follows:
nstat [OPTION] [ PATTERN [ PATTERN ] ]
You can view syntax information as well as options by running the -h help option.
nstat -h
or
nstat --help
Now that we have the basic syntax down let's take a look at the output of the command.
Breakdown of output
When running nstat with no additional options, you get the following results:
[tcarrigan@rhel ~]$ nstat
#kernel
IpInReceives 12057 0.0
IpInAddrErrors 1 0.0
IpInDelivers 12000 0.0
IpOutRequests 11060 0.0
IpOutNoRoutes 252 0.0
TcpActiveOpens 36 0.0
TcpEstabResets 3 0.0
TcpInSegs 11804 0.0
TcpOutSegs 10960 0.0
TcpRetransSegs 3 0.0
TcpOutRsts 29 0.0
UdpInDatagrams 196 0.0
UdpOutDatagrams 246 0.0
Ip6InReceives 18 0.0
Ip6OutRequests 31 0.0
Ip6OutNoRoutes 248 0.0
Ip6InMcastPkts 18 0.0
Ip6OutMcastPkts 31 0.0
Ip6InOctets 1715 0.0
Ip6OutOctets 2791 0.0
Ip6InMcastOctets 1715 0.0
Ip6OutMcastOctets 2791 0.0
Ip6InNoECTPkts 18 0.0
Icmp6OutMsgs 13 0.0
Icmp6OutRouterSolicits 3 0.0
Icmp6OutNeighborSolicits 2 0.0
Icmp6OutMLDv2Reports 8 0.0
Icmp6OutType133 3 0.0
Icmp6OutType135 2 0.0
Icmp6OutType143 8 0.0
Udp6OutDatagrams 18 0.0
TcpExtTW 19 0.0
TcpExtDelayedACKs 37 0.0
TcpExtTCPHPHits 10981 0.0
TcpExtTCPPureAcks 142 0.0
TcpExtTCPHPAcks 267 0.0
TcpExtTCPLossUndo 3 0.0
TcpExtTCPTimeouts 3 0.0
TcpExtTCPAbortOnClose 3 0.0
TcpExtTCPRcvCoalesce 327 0.0
TcpExtTCPAutoCorking 5 0.0
TcpExtTCPSynRetrans 3 0.0
TcpExtTCPOrigDataSent 390 0.0
TcpExtTCPHystartTrainDetect 1 0.0
TcpExtTCPHystartTrainCwnd 17 0.0
TcpExtTCPWinProbe 1 0.0
TcpExtTCPDelivered 424 0.0
IpExtInMcastPkts 41 0.0
IpExtOutMcastPkts 47 0.0
IpExtInOctets 54131913 0.0
IpExtOutOctets 829632 0.0
IpExtInMcastOctets 3902 0.0
IpExtOutMcastOctets 4142 0.0
IpExtInNoECTPkts 48401 0.0
Notice that while this is a longer output, almost all of this information is useful, given the right circumstance. You can use a variety of options to change the output to include or exclude specific fields as well as change the formatting of the output altogether.
As much of this output is RAW, it can be difficult to understand these values and what they mean to you. I found this resource on the web that does a great job of explaining the various data fields. .
Options to know
-a, --ignore - Dump absolute values of counters. (The default calculates the increments since the previous run)
[tcarrigan@rhel ~]$ nstat -a
#kernel
IpInReceives 12064 0.0
IpInAddrErrors 1 0.0
IpInDelivers 12007 0.0
IpOutRequests 11069 0.0
IpOutNoRoutes 252 0.0
TcpActiveOpens 36 0.0
TcpEstabResets 3 0.0
TcpInSegs 11804 0.0
TcpOutSegs 10960 0.0
TcpRetransSegs 3 0.0
TcpOutRsts 29 0.0
UdpInDatagrams 203 0.0
UdpOutDatagrams 255 0.0
Ip6InReceives 18 0.0
Ip6OutRequests 31 0.0
Ip6OutNoRoutes 248 0.0
Ip6InMcastPkts 18 0.0
Ip6OutMcastPkts 31 0.0
Ip6InOctets 1715 0.0
Ip6OutOctets 2791 0.0
Ip6InMcastOctets 1715 0.0
Ip6OutMcastOctets 2791 0.0
Ip6InNoECTPkts 18 0.0
Icmp6OutMsgs 13 0.0
Icmp6OutRouterSolicits 3 0.0
Icmp6OutNeighborSolicits 2 0.0
Icmp6OutMLDv2Reports 8 0.0
Icmp6OutType133 3 0.0
Icmp6OutType135 2 0.0
Icmp6OutType143 8 0.0
Udp6OutDatagrams 18 0.0
TcpExtTW 19 0.0
TcpExtDelayedACKs 37 0.0
TcpExtTCPHPHits 10981 0.0
TcpExtTCPPureAcks 142 0.0
TcpExtTCPHPAcks 267 0.0
TcpExtTCPLossUndo 3 0.0
TcpExtTCPTimeouts 3 0.0
TcpExtTCPAbortOnClose 3 0.0
TcpExtTCPRcvCoalesce 327 0.0
TcpExtTCPAutoCorking 5 0.0
TcpExtTCPSynRetrans 3 0.0
TcpExtTCPOrigDataSent 390 0.0
TcpExtTCPHystartTrainDetect 1 0.0
TcpExtTCPHystartTrainCwnd 17 0.0
TcpExtTCPWinProbe 1 0.0
TcpExtTCPDelivered 424 0.0
IpExtInMcastPkts 41 0.0
IpExtOutMcastPkts 47 0.0
IpExtInOctets 54132445 0.0
IpExtOutOctets 830316 0.0
IpExtInMcastOctets 3902 0.0
IpExtOutMcastOctets 4142 0.0
IpExtInNoECTPkts 48408 0.0
-z, --zeroes - Dumps all zeroes counters. These are ignored by default.
*Note this output is shortened for display*
[tcarrigan@rhel ~]$ nstat -z
#kernel
IpInReceives 4 0.0
IpInHdrErrors 0 0.0
IpInAddrErrors 0 0.0
IpForwDatagrams 0 0.0
IpInUnknownProtos 0 0.0
IpInDiscards 0 0.0
IpInDelivers 4 0.0
IpOutRequests 4 0.0
IpOutDiscards 0 0.0
IpOutNoRoutes 0 0.0
IpReasmTimeout 0 0.0
IpReasmReqds 0 0.0
IpReasmOKs 0 0.0
IpReasmFails 0 0.0
IpFragOKs 0 0.0
IpFragFails 0 0.0
IpFragCreates 0 0.0
-r, --reset - Resets the history, thus excluding averages since the last run.
[tcarrigan@rhel ~]$ nstat -r
#kernel
IpInReceives 12069 0.0
IpInAddrErrors 1 0.0
IpInDelivers 12012 0.0
IpOutRequests 11074 0.0
IpOutNoRoutes 252 0.0
TcpActiveOpens 36 0.0
TcpEstabResets 3 0.0
TcpInSegs 11804 0.0
TcpOutSegs 10960 0.0
TcpRetransSegs 3 0.0
TcpOutRsts 29 0.0
UdpInDatagrams 208 0.0
UdpOutDatagrams 260 0.0
Ip6InReceives 18 0.0
Ip6OutRequests 31 0.0
Ip6OutNoRoutes 248 0.0
Ip6InMcastPkts 18 0.0
Ip6OutMcastPkts 31 0.0
Ip6InOctets 1715 0.0
Ip6OutOctets 2791 0.0
Ip6InMcastOctets 1715 0.0
Ip6OutMcastOctets 2791 0.0
Ip6InNoECTPkts 18 0.0
Icmp6OutMsgs 13 0.0
Icmp6OutRouterSolicits 3 0.0
Icmp6OutNeighborSolicits 2 0.0
Icmp6OutMLDv2Reports 8 0.0
Icmp6OutType133 3 0.0
Icmp6OutType135 2 0.0
Icmp6OutType143 8 0.0
Udp6OutDatagrams 18 0.0
TcpExtTW 19 0.0
TcpExtDelayedACKs 37 0.0
TcpExtTCPHPHits 10981 0.0
TcpExtTCPPureAcks 142 0.0
TcpExtTCPHPAcks 267 0.0
TcpExtTCPLossUndo 3 0.0
TcpExtTCPTimeouts 3 0.0
TcpExtTCPAbortOnClose 3 0.0
TcpExtTCPRcvCoalesce 327 0.0
TcpExtTCPAutoCorking 5 0.0
TcpExtTCPSynRetrans 3 0.0
TcpExtTCPOrigDataSent 390 0.0
TcpExtTCPHystartTrainDetect 1 0.0
TcpExtTCPHystartTrainCwnd 17 0.0
TcpExtTCPWinProbe 1 0.0
TcpExtTCPDelivered 424 0.0
IpExtInMcastPkts 41 0.0
IpExtOutMcastPkts 47 0.0
IpExtInOctets 54132825 0.0
IpExtOutOctets 830696 0.0
IpExtInMcastOctets 3902 0.0
IpExtOutMcastOctets 4142 0.0
IpExtInNoECTPkts 48413 0.0
You can also use the following options to change the time intervals for reports:
-d, --scan x - Run in daemon mode to collect statistics. x is an interval between measurements in seconds.
-t, --interval x : Where x is the interval to average rates. The default value is 60 seconds.
For more options, check out the man page for this command: man nstat
Wrap up
To summarize, we looked at the overall purpose of the nstat command. Knowing where we came from, with netstat, allows us to appreciate nstat and its goal of providing more useful data. We looked at the syntax of the command, as well as some of the various options that can be utilized. If more information is needed, be sure to check the man pages or your favorite search engine. If you have another command that you would like to see covered, send an email to the team at enable-sysadmin@redhat.com!
[ Want more for your network? Download a free ebook on network automation with Ansible. ]
Tyler Carrigan
Tyler is the Sr. Community Manager at Enable Sysadmin, a submarine veteran, and an all-round tech enthusiast! He was first introduced to Red Hat in 2012 by way of a Red Hat Enterprise Linux-based combat system inside the USS Georgia Missile Control Center. More about me
Try Red Hat Enterprise Linux
Download it at no charge from the Red Hat Developer program.
Related Content
