nstat

View network statistics since last time nstat was run

$ nstat

$ nstat [[-a|--ignore]]

$ nstat [[-h|--help]]

nstat [options]

-a
    Show all counters, including those with a value of zero.

-z
    Only show counters with a value of zero.

-h
    Display help message and exit.

-v
    Display version information and exit.

nstat is a command-line utility in Linux used to display network statistics. It provides a detailed view of various network counters and can be particularly useful for diagnosing network-related issues and monitoring network performance. It gathers information from the /proc/net/dev file system, which contains real-time data regarding network interfaces and their activities. Unlike netstat (now deprecated and superseded by ss), nstat provides more granular information about network packet statistics, including packet counts, error counts, and dropped packets. It gives a summary of network interface traffic by reporting values related to packets and octets. It provides a way to monitor network performance in real-time, which can aid in identifying bottlenecks, errors, or suspicious activity. Using nstat can help determine whether dropped packets are due to hardware limitations, software configuration issues, or network congestion.

The information provided by nstat is a snapshot in time. Continuous monitoring or aggregation over time is necessary for meaningful trend analysis.
The availability and specific counters might vary slightly depending on the kernel version and specific network drivers.

The output of nstat typically includes a list of counters with their respective values. These counters are usually categorized by interface and protocol. Important counters to look for include IpExtInNoRoutes, TcpRetransSegs, TcpCurrEstab, and various error counters.

Run nstat -a to view all counters, including those with zero values. The raw output can be quite verbose. You can combine it with tools like grep to filter specific counters of interest. For example: nstat -a | grep TcpRetransSegs will display the number of retransmitted TCP segments.

nstat appeared later compared to older tools like netstat, filling a need for more granular network statistics. Its creation was likely driven by the increasing complexity of network protocols and the need for better troubleshooting tools. While netstat focused on connections and routing, nstat centered on packet-level statistics, directly from the /proc filesystem. It is less commonly used than ss for connection information but still relevant for its unique packet counter information.

ss(8), netstat(1), ip(8), tcpdump(1)