Linux Commands

NSTAT Linux Command

Linux offers various tools that you can use to get the network statistics. One of the network statistic tools is the nstat command. With nstat, you can easily see the kernel SNMP counters and retrieve the network interface statistics.

The common network statistic tool is netstat. However, nstat comes in handy and in some cases, it is your best option over the other tools. Let’s see how nstat works. 

The nstat Command

The nstat tool retrieves statistics about the network and SNMP counters from two files, proc/net/netstat and proc/net/snmp. The format of the contents of the two files is not human-readable, and that’s where the nstat command comes in.

In most Linux distros, the nstat command is provided by the iproute2 package. Besides, it is nstat that provides the IP command in Linux systems.

How to Use nstat

The syntax for using nstat is:

$ nstat [option] [pattern [ pattern]]

You can start by opening the help page to see the available options that you can use.

$ nstat -h

View Network Statistics

You can display the statistics of the network by running the nstat command with no options. The command, by default, calculates increments since the last use and shows them on the output.

$ nstat

The output will be:

The output above and all the information is helpful depending on the circumstance. Let’s try to understand some of the information in the output.

  1. IpInReceives – the representation of the total input datagrams, including those received in error from the interfaces. We can see that in our case, the total number is 2697.
  2. TcpInSegs –the total segments received, including those with errors.
  3. TcpOutSegs – the number of segments sent, exclusive of those with only retransmitted octets.
  4. UdpInDatagrams – the total UDP datagrams delivered to all the UDP users.

Each of this information is useful and there are many options that you can add to the command to tweak the output.

Basic nstat Options

1. Dump Absolute Counter Values
Using the nstat command alone only displays the increments of the statistical values since its last use. However, you can dump the absolute values to add to the statistics using the -a option.

The new command will be:

$ nstat -a

Note that the new network statistics differ from those above in the output below. Furthermore, using the -a option produces more information than nstat alone.

2. View Update History
If you want to see the updated history of the changes in the network statistics, if any, without displaying any other output, use the -n option.

$ nstat -n

You can also choose not to update the history to see the accumulated counters using the -s option.

3. View All Statistics
When using nstat, network parameters with zero values don’t get displayed in the output, but that doesn’t limit you from accessing them. The – -zero option will include the zero values to the output.

$ nstat –zero

Our new output will be:

The output above now includes network information with 0 numbers.

4. Reset History
We’ve seen how you can update or choose not to update the history and use it in the next counters. You can sometimes decide to reset the historical statistics and start analyzing the network statics fresh. The -r option will aid you with that.

$ nstat -r

The output will now include only the recent counters.

5. Check Version
To quickly get the version information of nstat, run the command:

$ nstat -V

6. Display Network Statics in JSON Format
You can choose to use the JSON format for the output. All you need is to add – -json to the command.

$ nstat –json

netstat vs nstat – What’s the Difference?

Both nstat and netstat are network statistics tools. and they all cite the source of the information through the /proc files. The output when using netstat is more human-readable compared to that of nstat. Nevertheless, nstat displays all the raw metrics and information provided by the kernel, and its output is more compared to that of netstat

Furthermore, to access the netstat command, you need to install net-tools.

Let’s take a quick comparison example of the statistics provided by the two command-line utilities.

For nstat, its partial output is:

On the other hand, the output for netstat is:

The netstat output is more readable, but still, both tools are useful.

Conclusion

This guide has presented the nstat command and how you can use it to retrieve the network statistics. We’ve seen its syntax and common usage examples. Even though there are other network statistics tools that you can use, knowing how to use nstat is also a lifesaver.

About the author

Denis Kariuki

Denis is a Computer Scientist with a passion for Networking and Cyber Security. I love the terminal, and using Linux is a hobby. I am passionate about sharing tips and ideas about Linux and computing.