Home > Linux, 工具介绍, 源码分析 > nicstat 网络流量统计利器

nicstat 网络流量统计利器

February 27th, 2013 Leave a comment Go to comments

原创文章,转载请注明: 转载自系统技术非业余研究

本文链接地址: nicstat 网络流量统计利器

前段时间看到brendangregg的 Linux Performance Analysis and Tools PPT里面提到的nicstat,研究了下是个不错的东西,分享给大家。

nicstat is to network interfaces as “iostat” is to disks, or “prstat” is to processes.

nicstat原本是Solaris平台下显示网卡流量的工具,Tim Cook将它移植到linux平台,官方网站见 这里。 相比netstat, 他有以下关键特性:

  • Reports bytes in & out as well as packets.
  • Normalizes these values to per-second rates.
  • Reports on all interfaces (while iterating)
  • Reports Utilization (rough calculation as of now)
  • Reports Saturation (also rough)
  • Prefixes statistics with the current time

我们来体验下,首先安装之,源码在 这里 下, 目前最新的版本是1.92。
解开后,由于这个版本默认是在32位linux下编译,所以需要改下Makefile.Linux:

$ uname -r
2.6.32-131.21.1.tb477.el6.x86_64
$ diff Makefile.Linux64 Makefile.Linux
17c17
< CFLAGS =      $(COPT) -m32
---
> CFLAGS =      $(COPT)

$ sudo make -f Makefile.Linux install  
sudo install -o root -g root -m 4511 `./nicstat.sh --bin-name` /usr/local/bin/nicstat
sudo install -o bin -g bin -m 555 enicstat /usr/local/bin
sudo install -o bin -g bin -m 444 nicstat.1 /usr/local/share/man/man1/nicstat.1

enicstat就安装好可以使用了。

使用文档在这里: man nicstat
由于在linux下需要获取网卡的speed等信息,需要以特权用户运行。

$ sudo enicstat -l
Int      Loopback   Mbit/s Duplex State
lo            Yes        -   unkn    up
eth0           No     1000   full    up
bond0          No        0   unkn    up

$ sudo enicstat 
    Time      Int   rKB/s   wKB/s   rPk/s   wPk/s    rAvs    wAvs %Util    Sat
13:04:10       lo   161.1   161.1   489.2   489.2   337.3   337.3  0.00   0.00
13:04:10     eth0   601.9   589.1  1868.1  1894.1   330.0   318.5  0.98   0.00
13:04:10    bond0   601.9   589.1  1868.1  1894.1   330.0   318.5  0.00   0.00

上面很特色的一个选项就是网卡的Util(利用率)以及Saturation(This the number of errors/second seen for the interface)在实践中用途挺大的。

通过strace和源码进行简单的分析:

open(“/proc/net/dev”, O_RDONLY) = 3
open(“/proc/net/snmp”, O_RDONLY) = 5
open(“/proc/net/netstat”, O_RDONLY) = 6
open(“/proc/uptime”, O_RDONLY) = 9

大部分网卡相关的统计信息是从上面3个文件获取到的,其中snmp文件提供了tcp和udp的统计信息。

默认统计信息是以KB为单位,-M选项可以更改为以M为单位,演习如下:

$ sudo enicstat -M
    Time      Int   rMbps   wMbps   rPk/s   wPk/s    rAvs    wAvs %Util    Sat
13:14:51       lo    1.26    1.26   489.1   489.1   337.3   337.3  0.00   0.00
13:14:51     eth0    4.70    4.60  1868.0  1894.0   330.0   318.5  0.98   0.00
13:14:51    bond0    4.70    4.60  1868.0  1894.0   330.0   318.5  0.00   0.00

nicstat还提供了tcp链接外联和内联的个数,重置,Drops信息还有包重传率等信息,这些信息对于诊断tcp问题挺有用的。

$ sudo enicstat -t
13:09:40    InKB   OutKB   InSeg  OutSeg Reset  AttF %ReTX InConn OutCon Drops
TCP         0.00    0.00  2123.7  2251.7  1.84  0.79 0.000   7.16   2.95  0.00

最后需要注意的是, 解读输出信息的时候:

NOTES
On Linux, the NoCP, Defer, TCP InKB, and TCP OutKB statistics are always reported as zero.

The way that saturation is reported is a best effort, as there is no standardized naming to capture
all errors related to an interface’s inability to receive or transmit a packet. Monitoring %Util and
packet rates, along with an understanding of the specific NICs may be more useful in judging whether
you are nearing saturation.

祝玩得开心!

Post Footer automatically generated by wp-posturl plugin for wordpress.

  1. February 27th, 2013 at 17:59 | #1

    我使用的是centos 5.6 2.6.18-238.el5 的核,装不上呐

    [Reply]

    Yu Feng Reply:

    源码编译肯定没问题的呀,要改下makefile.

    [Reply]

    zhangyue Reply:

    是的,改了就好了,tks

    [Reply]

  2. sunvince
    March 8th, 2013 at 18:31 | #2

    咱能去掉wordpress和google-analytics么… 或者给放到后面… 要不然不翻墙,正文不显示啊

    [Reply]

    Yu Feng Reply:

    这样呀,我看看如何搞

    [Reply]

  3. 不了峰
    March 23rd, 2013 at 22:42 | #3

    iftop 用来看网卡流量也挺好玩的

    [Reply]

  1. February 27th, 2013 at 22:29 | #1
  2. February 27th, 2013 at 22:33 | #2
  3. March 18th, 2013 at 16:17 | #3
  4. May 9th, 2015 at 15:08 | #4
  5. July 7th, 2015 at 23:43 | #5
  6. January 31st, 2016 at 23:18 | #6