lnstat

lnstat [OPTION...]

Common usage:
lnstat
lnstat -d delay
lnstat -f file

-f file
    Reads statistics from the specified file instead of the default /proc/net/stat. This is useful for analyzing saved snapshots of statistics.

-r
    Displays raw kernel statistics. This option typically shows more detailed, less human-readable counters directly from the kernel, which might be useful for specific debugging scenarios.

-c
    Displays column headers for the output. Without this option, only the statistical values are shown, making interpretation harder for the first line of output or when new fields appear.

-d delay
    Repeats the display of statistics indefinitely, with a delay in seconds between each refresh. Similar to other system monitoring tools like vmstat or iostat, this allows for real-time monitoring of network stack changes.

-V
    Displays the version information for the lnstat command and exits.

The lnstat command, part of the widely-used iproute2 suite, provides a concise summary of aggregated statistics from various Linux kernel networking subsystems. It retrieves raw data primarily from the /proc/net/stat virtual filesystem entry, offering insights into low-level network activity.

Unlike tools such as netstat or ss which focus on active connections and sockets, lnstat delves into system-wide counters related to routing table lookups, neighbor table entries, various IP protocol statistics (IPv4, IPv6, TCP, UDP, ICMP), and more. This makes it invaluable for network administrators and developers debugging performance issues, identifying potential bottlenecks, or monitoring the overall health of the network stack.

Its output is often dense and requires some understanding of kernel networking internals to interpret fully, but it provides a critical, low-overhead view of how the network stack is behaving at a fundamental level.

The output of lnstat can be quite cryptic and requires familiarity with Linux kernel networking internals to fully interpret. It primarily reports aggregated, system-wide counters, not per-process or per-connection statistics.

While it generally doesn't require elevated privileges to run (as it reads from /proc which is often world-readable), some systems or specific configurations might restrict access to the underlying data. The format and content of the statistics can also vary slightly between different kernel versions.

lnstat is a utility developed as part of the iproute2 project, which was initiated by Alexey Kuznetsov. The iproute2 suite emerged as the modern replacement for the traditional net-tools package (ifconfig, route, netstat, etc.) in Linux, leveraging the more advanced Netlink socket interface for interacting with the kernel.

While many iproute2 tools utilize Netlink, lnstat primarily relies on reading directly from the /proc filesystem, specifically /proc/net/stat, to gather its aggregated network statistics. Its purpose has remained consistent: to provide a lean, low-level view of the kernel's internal network counters for diagnosis and monitoring.

ip(8), ss(8), netstat(8), nstat(8), vmstat(8), iostat(1)