capstats - A tool to get some NIC statistics.
You can find the latest capstats release for download at http://www.bro.org/download.
Capstats's git repository is located at git://git.bro.org/capstats.git. You can browse the repository here.
This document describes capstats 0.24-2. See the
file for version history.
Here's an example output with output in one-second intervals until
CTRL-C is hit:
Each line starts with a timestamp and the other fields are:
pkts: Absolute number of packets seen by
kpps: Number of thousands of packets per second. kbytes: Absolute number of KBytes during interval. mbps: Mbits/sec. nic_pkts: Number of packets as reported by
pcap_stats()(may not match pkts)
nic_drops: Number of packet drops as reported by
u: Number of UDP packets. t: Number of TCP packets. i: Number of ICMP packets. o: Number of IP packets with protocol other than TCP, UDP, and ICMP. nonip: Number of non-IP packets.
A list of all options:
capstats [Options] -i interface -i| --interface <interface> Listen on interface -d| --dag Use native DAG API -f| --filter <filter> BPF filter -I| --interval <secs> Stats logging interval -l| --syslog Use syslog rather than print to stderr -n| --number <count> Stop after outputting <number> intervals -N| --select Use select() for live pcap (for testing only) -p| --payload <n> Verifies that packets' payloads consist entirely of bytes of the given value. -q| --quiet <count> Suppress output, exit code indicates >= count packets received. -S| --size <size> Verify packets to have given <size> -s| --snaplen <size> Use pcap snaplen <size> -v| --version Print version and exit -w| --write <filename> Write packets to file
capstats has been tested on Linux, FreeBSD, and MacOS. Please see
INSTALL file for installation instructions.