ifstat - Report InterFace STATistics
ifstat [-a] [-l] [-z] [-n] [-v] [-h] [-t] [-i if0,if1,...] [-d
drv[:opt]] [-s [comm@][#]host[/nn]] [-T] [-A] [-w] [-W] [-S] [-b] [-q]
Ifstat is a little tool to report interface activity, just like
iostat/vmstat do for other system statistics.
ifstat accepts the following options:
-l Enables monitoring of loopback interfaces for which statistics are
available. By default, ifstat monitors all non-loopback interfaces
that are up.
-a Enables monitoring of all interfaces found for which statistics are
-z Hides interface which counters are null, eg interfaces that are up
but not used.
-i Specifies the list of interfaces to monitor, separated by commas
(if an interface name has a comma, it can be escaped with ’\’).
Multiple instances of the options are added together.
-s Equivalent to -d snmp:[comm@][#]host[/nn]] to poll a remote host
through SNMP. See below for details.
-h Displays a short help message.
-n Turns off displaying the header periodically.
-t Adds a timestamp at the beginning of each line.
-T Reports total bandwith for all monitored interfaces.
-A Disables use of interface indexes: by default, when polling
mechanism is index based (snmp, ifmib), ifstat remembers indexes of
monitored interfaces to poll only them. However, if interfaces
indexes change often (new interfaces added, etc), you might loose
some stats, hence this flag. Note that if you ask ifstat to monitor
a non existent interface, it will poll all interfaces until it
finds the requested one (regardless of this flag) so you can poll
for an interface that goes up and down.
-w Uses fixed width columns, instead of enlarging them if needed for
interfaces names to fit.
-W Wrap lines that are larger than the terminal width (implies -w).
Wrapped lines are prefixed with a cycling letter to ease reading.
-S Keep stats updated on the same line if possible (no scrolling nor
-b Reports bandwith in kbits/sec instead of kbytes/sec.
-q Quiet mode, warnings are not printed.
-v Displays version and the compiled-in drivers.
-d Specifies a driver to use to gather stats and an eventual option
for this driver separated of the driver name by a colon. If this is
not specified, ifstat uses the first driver compiled in, with no
The following drivers are available (depending on the operating
system and compile-time options, not all of them might be present):
This driver gets statistics from Linux’s /proc/net/dev file. An
alternate file name to get stats from can be passed as the
This driver gets statistics from FreeBSD’s ifmib sysctl. It
doesn’t accept any options.
This driver gets statistics from Solaris kstat interface. It
doesn’t accept any options.
This driver gets statistics using SIOCGIFDATA ioctl under IRIX
and OpenBSD (different semantics). It doesn’t accept any
This driver gets statistics using routing sysctl on BSD based
systems. It doesn’t accept any options.
kvm This driver gets statistics by reading the kernel live
structures. It accepts an option specifying which files/devices
to use in the following format :
[execfile][,[corefile][,swapfile]] (see kvm_open(3) for details
on those fields). If a null string is passed for a parameter,
the system default will be used for it.
Note that for this driver to work, ifstat needs to have read
access to the system memory device. This is usually done by
running it as root, or by installing setgid mem or kmem. ifstat
will NOT install setgid by default; It is up to you to decide
if you trust it.
This driver gets statistics using the DLPI streams interface
available on HP-UX. An alternate device to query statistics
from can be passed as the option (default is /dev/dlpi).
This driver gets statistics using the GetIfTable interface
available on Win32 systems. It doesn’t accept any options.
This driver gets statistics through SNMP. The option, in the
form [comm@][#]host[/nn]], specifies the host and eventual
community to poll. Default community is public, but can be
changed by prepending "comm@" to the hostname. If host starts
by a #, interface names are generated from their index as
‘ifNN’ (this is a workaround for some equipments that give all
interfaces the same description). Default host is localhost,
and this will be used by default if snmp is the only available
The driver will try to poll several interfaces at once by
grouping requests in SNMP packets. By default interfaces will
be polled by group of 8. If this doesn’t work well with your
equipments, you can lower that number by suffixing the hostname
with /nn, where nn is the number of interfaces to poll at once.
You can also increase the number if you want to poll a large
number of interfaces efficiently and if your server supports
delay is the delay between updates in seconds, which defaults to 1.
A decimal number can be specified for intervals shorter than a
second. (minimum 0.1)
A second delay can also be specified (separated from the first one
by a ’/’). In that case the first delay will be used for the first
poll after start and the second one will be used for all following
polls (This can be used to have a "fast" start when running for a
long while with a big delay).
count is the number of updates before stopping. If not specified,
it is unlimited.
Gaël Roualland, <email@example.com>