nstat

View network statistics since last time nstat was run

$ nstat

$ nstat [[-a|--ignore]]

$ nstat [[-h|--help]]

nstat [ OPTIONS ]

Common OPTIONS include:
nstat [ -a ] [ -z ] [ -s ] [ -t | -T ] [ -o ] [ -d SECONDS ] [ -p PROTOCOL ] [ -n ] [ -r ]

-h
    Display a brief help message and exit.

-V
    Display the version of nstat and exit.

-a
    Show all available statistics, including those typically hidden or deemed less common.

-z
    Reset protocol statistics to zero. This operation requires root privileges.

-s
    Display SNMP (Simple Network Management Protocol) statistics. This is the default behavior if no other output format option is specified.

-t
    Display TCP statistics. This provides detailed counters specific to the Transmission Control Protocol.

-T
    Display TCP statistics in a more compact, tabular format, suitable for scripts or quick glances.

-o
    Show obsolete statistics. This option is primarily for backward compatibility and may display metrics that are no longer actively maintained or relevant in modern kernels.

-p PROTOCOL
    Specify which protocol's statistics to display. Common values include ip, icmp, tcp, udp. Using this option filters the output to only show metrics for the specified protocol.

-d SECONDS
    Display statistics repeatedly, updating every SECONDS. This allows for live monitoring of statistic changes over time.

-n
    Show numerical addresses instead of trying to resolve them into hostnames or service names.

-r
    Show raw statistics. This option displays the direct, untranslated values from the kernel without human-readable labels, useful for parsing.

nstat is a utility from the iproute2 package that provides detailed network statistics. Unlike older tools like netstat -s which might present a consolidated view, nstat aims to expose the raw, kernel-level statistics directly from files such as /proc/net/snmp and /proc/net/netstat. It can display various counters for IP, ICMP, TCP, UDP, and other protocols, offering insights into network activity, errors, and performance.

This command is particularly useful for network administrators and developers who need to monitor the health and behavior of network interfaces and protocol stacks. Its output is generally more structured and machine-readable compared to netstat -s, making it suitable for scripting and parsing. nstat is preferred in modern Linux environments for its accuracy and direct access to kernel statistics. It helps in diagnosing network issues like dropped packets, retransmissions, and protocol errors by presenting cumulative counts since system boot.

Resetting statistics using the -z option requires root privileges.

The statistics displayed by nstat are cumulative since system boot, meaning they are not reset unless explicitly done so with the -z option (or a system reboot). There is no built-in mechanism to show differential statistics directly for a specific time interval, although the -d option can be used to observe changes over time.

The specific set of available statistics and their names may vary slightly across different Linux kernel versions and iproute2 releases.

nstat retrieves its information primarily from the /proc/net/snmp and /proc/net/netstat pseudo-files within the kernel's virtual filesystem. These files expose various counters maintained by the network stack for different protocols (IP, ICMP, TCP, UDP, etc.), providing a low-level insight into network activity.

While netstat -s provides summary statistics for network protocols, nstat is generally considered a more precise and future-proof tool. netstat -s often parses aggregated output, whereas nstat is designed to directly expose the raw kernel counters, frequently presenting more detailed or slightly different metrics consistent with the iproute2 philosophy of direct kernel interaction.

nstat was introduced as part of the iproute2 utilities, a modern suite of network management tools designed to replace the older net-tools (e.g., netstat, route, ifconfig) in Linux distributions. Developed by Alexey Kuznetsov, the iproute2 suite aimed to provide more robust, efficient, and extensible network management capabilities aligned with advanced Linux kernel networking features. nstat specifically emerged to offer a more direct and accurate view of kernel-level network protocol statistics, leveraging the /proc/net/snmp and /proc/net/netstat files. Its integration into iproute2 emphasizes a unified approach to network configuration and monitoring, providing more granular and machine-readable output compared to its predecessors.

ip(8), netstat(8), ss(8), proc(5), snmp(7)