Go to main content

man pages section 1: User Commands

Exit Print View

Updated: Wednesday, February 9, 2022

nicstat (1)


nicstat - print network traffic statistics


nicstat  [-hvnsxpztualkMU]  [-iinterface] [-Sint:mbps[fd|hd]] [interval


nicstat(1)                  General Commands Manual                 nicstat(1)

       nicstat - print network traffic statistics

       nicstat  [-hvnsxpztualkMU]  [-iinterface] [-Sint:mbps[fd|hd]] [interval

       nicstat prints out network statistics for  all  network  cards  (NICs),
       including packets, kilobytes per second, average packet sizes and more.

       -h        Display brief usage information (help).

       -v        Display  nicstat version (and additional fields when combined
                 with '-l')

       -n        Show statistics for non-local (i.e. non-loopback)  interfaces

       -s        Display  summary  output  -  just the amount of data received
                 (read) and transmitted (written).

       -x        Display extended output.  See OUTPUT section for details.

       -U        Display separate read and write utilization statistics.  This
                 affects  the  default, extended (-x) and all (-a) format out-
                 puts. For the default format the "Sat" statistic  is  dropped
                 to fit the output in 80 columns.

       -M        Display interface throughput statistics in Mbps (megabits per
                 second), instead of the default KB/s (kilobytes per second).

                 NOTE - interface statistics are reported to operating systems
                 in  bytes.   nicstat does not know if Ethernet or other hard-
                 ware overheads are included in the statistic  on  each  plat-

       -p        Display  output  in  parseable format.  This outputs one line
                 per interface, in the following formats (which correspond  to
                 the default, -x, -t and -u options; respectively):

              Con:Drops time:UDP:InDG:OutDG:InErr:OutErr

                 where  time  is  the  number of seconds since midnight, Jan 1
                 1970 (UST) and the other fields are as described in the  OUT-
                 PUT section below.

                 NOTE - throughput statistics are always in KB/s (kilbytes per
                 second) for parseable formats, even if the "-M" flag has been

       -z        Skip interfaces for which there was zero traffic for the sam-
                 ple period.

       -t        Show TCP statistics.

       -u        Show UDP statistics.

       -a        Equvalent to '-x -t -u'.

       -l        Just list interfaces.

                 Show statistics for only the interface(s)  listed.   Multiple
                 interfaces can be listed, separated by commas (,).

       -k        Search  for  active  network  interfaces by looking for kstat
                 "link_state" statistics with a value of 1.  This is  only  of
                 value  on  systems  running  Solaris 10 (or early releases of
                 Solaris 11 Express),  with  Exclusive  IP  Zones,  where  the
                 interfaces  given  to  an Exclusive IP Zone are not otherwise
                 visible.  If you are  running  Solaris  9  (or  earlier),  or
                 Solaris 11 (or later) you do not need this option.

       interval  Specifies the number of seconds between samples.

       count     Specifies  the  number  of  times  that  the  statistics  are
                 repeated.  If no count is specified, nicstat will repeat sta-
                 tistics indefinitely.

       The fields of nicstat's display are:

       Time      The  time  corresponding  to  the end of the sample shown, in
                 HH:MM:SS format (24-hour clock).

       Int       The interface name.

       rKB/s, InKB
                 Kilobytes/second read (received).

       wKB/s, OutKB
                 Kilobytes/second written (transmitted).

       rMbps, RdMbps
                 Megabits/second read (received).

       wMbps, WrMbps
                 Megabits/second written (transmitted).

       rPk/s, InSeg, InDG
                 Packets (TCP Segments, UDP Datagrams)/second read (received).

       wPk/s, OutSeg, OutDG
                 Packets (TCP Segments, UDP Datagrams)/second written  (trans-

       rAvs      Average size of packets read (received).

       wAvs      Average size of packets written (transmitted).

       %Util     Percentage  utilization  of  the  interface.  For full-duplex
                 interfaces, this is the greater of rKB/s or wKB/s as  a  per-
                 centage  of the interface speed.  For half-duplex interfaces,
                 rKB/s and wKB/s are summed.

       %rUtil, %wUtil
                 Percentage utilization for bytes read  and  written,  respec-

       Sat       Saturation.   This  the  number of errors/second seen for the
                 interface - an indicator the  interface  may  be  approaching
                 saturation.  This statistic is combined from a number of ker-
                 nel statistics.  It is recommended to use the '-x' option  to
                 see  more  individual statistics (those mentioned below) when
                 attempting to diagnose a network issue.

       IErr      Packets received that could not  be  processed  because  they
                 contained errors

       OErr      Packets  that  were  not  successfully transmitted because of

       Coll      Ethernet collisions during transmit.

       NoCP      No-can-puts.  This is when an incoming packet can not be  put
                 to  the  process reading the socket.  This suggests the local
                 process is unable to process incoming  packets  in  a  timely

       Defer     Defer  Transmits.   Packets  without  collisions  where first
                 transmit attempt was delayed because the medium was busy.

       Reset     tcpEstabResets. The number of times TCP connections have made
                 a  direct  transition  to  the  CLOSED  state from either the
                 ESTABLISHED state or the CLOSE-WAIT state.

       AttF      tcpAttemptFails - The number of times  that  TCP  connections
                 have made a direct transition to the CLOSED state from either
                 the SYN-SENT state or the SYN-RCVD state, plus the number  of
                 times  TCP  connections  have made a direct transition to the
                 LISTEN state from the SYN-RCVD state.

       %ReTX     Percentage of TCP segments retransmitted - that is, the  num-
                 ber of TCP segments transmitted containing one or more previ-
                 ously transmitted octets.

       InConn    tcpPassiveOpens - The number of times  that  TCP  connections
                 have  made a direct transition to the SYN-RCVD state from the
                 LISTEN state.

       OutCon    tcpActiveOpens - The number of  times  that  TCP  connections
                 have  made a direct transition to the SYN-SENT state from the
                 CLOSED state.

       Drops     tcpHalfOpenDrop + tcpListenDrop + tcpListenDropQ0.

       tcpListenDrop and tcpListenDropQ0 - Number of connections dropped  from
       the completed connection queue and incomplete connection queue, respec-
       tively.  tcpHalfOpenDrops - Number of  connections  dropped  after  the
       initial SYN packet was received.

       The first set of statistics printed are averages since system boot.  If
       no interval operand is specified, or a count value of "1" is specified,
       this will be the only sample printed.

       Print average statistics from boot time to now only:

            $ nicstat

       Print statistics for all interfaces, every 3 seconds:

            $ nicstat 3

       Print  statistics  for all interfaces, every 5 seconds, finishing after
       10 samples:

            $ nicstat 5 10

       Print statistics every  3  seconds,  only  for  interfaces  "hme0"  and

            $ nicstat -i hme0,hme1 3

       Print  statistics for non-local interfaces, setting speed of "eth0" and
       "eth1" to 10mbps/half-duplex and 1000mbps/full-duplex, respectively:

            $ nicstat -n -S eth0:10h,eth1:1000 5

       netstat(8) kstat(8), kstat(3KSTAT), mibiisa(8)

       "nicstat - the Solaris and Linux Network Monitoring Tool  You  Did  Not
       Know      You      Needed"     -http://blogs.oracle.com/timc/entry/nic-

       See attributes(7) for descriptions of the following attributes:

       |Availability   | diagnostic/nicstat |
       |Stability      | Volatile           |

       The way that saturation is reported is a best effort, as  there  is  no
       standardized  naming  to  capture  all errors related to an interface's
       inability to receive or transmit a packet.  Monitoring %Util and packet
       rates,  along  with  an  understanding of the specific NICs may be more
       useful in judging whether you are nearing saturation.

       Source code for open source software components in Oracle  Solaris  can
       be found at https://www.oracle.com/downloads/opensource/solaris-source-

       This    software    was    built    from    source     available     at
       https://github.com/oracle/solaris-userland.    The  original  community
       source  was  downloaded   from    https://sourceforge.net/projects/nic-

       Further information about this software can be found on the open source
       community website at https://sourceforge.net/projects/nicstat/.

4th Berkeley Distribution         27 Jan 2014                       nicstat(1)