PKTSTAT(1) BSD General Commands Manual PKTSTAT(1)

pktstat - display packet activity on a crt

pktstat [-BcFlnpPtT] [-a abbrev] [-A file] [-i interface] [-k keeptime]
[-m maxbps] [-w waittime] [filter-expr]

The pktstat program displays a real-time summary of packet activity on an
interface. Each line displays the data rate associated with a particular
class of packets. The class is determined by the packet header.

pktstat understands the following command line options:

-a abbrev
Add abbrev to the list of abbreviation patterns.

-A file
Read abbreviation patterns from the given file. (See
Abbreviations, below.) If the option -A none is given, then
default abbreviation files are not loaded.

-B Display data rates in bytes per second (Bps) instead of in
bits per second (bps).

-c Do not combine some packet classes into one class. For exam‚
ple, TCP connections are kept as two separate flows.

-F Show full hostnames. Normally, hostnames are truncated to
the first component of their domain name before display.

-i interface
Listen on the given interface. If not specified, a suitable
interface is chosen.

-k keeptime
When no packets have been seen for a particular class, retain
an entry on the display for this many screen seconds.
Defaults to 10.

-l Display and sort flows by when they were last seen. (Incom‚
patible with -t)

-m maxbps
Fix the maximum bit rate for the interface at maxbps instead
of auto detecting it.

-n Do not try and resolve hostnames or service port numbers.

-p Show packet counts instead of bit counts.

-P Do not try to put the interface into promiscuous mode.

-t "Top" mode. Sorts the display by bit count (or packet count
if -p was given) instead of by the name.

-T Show bit (byte) totals for flows.

-w waittime
Refresh the display every waittime seconds. The default is 5

Ignore all data not matching the given filter-expression. If
no filter is provided, all packets are considered.

If the terminal supports it, the display briefly highlights in bold new
connections or old connections carrying data after a period of inactiv‚

Simple statistics about the interface are also displayed such as the cur‚
rent and average bit rates (measured just above the data link layer).
Load averages refer to bit rate decayed averages for the last 1, 5 and 15

During display, the following keystrokes are recognised:

q quit

Ctrl-L redraw screen

t toggle the -t flag (top mode)

T toggle the -T flag (totals mode)

n toggle the -n flag (numeric display)

p toggle the -p flag (packets instead of bits)

b | B toggle the -B flag (bps or Bps)

f | F toggle the -F flag (full hostnames)

r reset collected statistics (min, max, etc.), flush flow
history and reset DNS/service caches

l show and sort flows by when they were last active

? toggle display of help/status text at the bottom of the

Packet classes
All packet classes, or flows, are "tagged" with a descriptive string,
such as ‚tcp ftpserver:20524 <-> cathexis:17771‚.

In addition to being tagged, some protocol-state information can be asso‚
ciated with a flow. This is displayed immediately below a flow line.
Descriptive information for FTP, HTTP, X11 and SUP connections is deter‚
mined from simple decoding of some packets. If the connection is ‚open‚,
it is introduced with a right angle shape (+), otherwise it is introduced
with a hyphen character.

tcp www:80 <-> hamartia:19179
+ GET /index.html

Abbreviation patterns are a way of further combining flows. As packets
are decoded, their flow name is constructed at the various protocol lay‚
ers. At address combining stage (where arrows such as ‚->‚ are inserted)
and at the final display stage, names are checked against a list of
abbreviation patterns, and the abbreviation‚s name substituted if a match
is found. For example, the pattern ‚* <-> *:domain‚ will match DNS pack‚
ets in both the UDP and TCP layers.

Abbreviations take the form [[email protected]]pattern. The pattern part can contain
the wildcard character, asterisk ‚*‚ which matches zero or more non-space
characters. The space character matches one or more whitespace charac‚
ters. Leading and trailing spaces are ignored.

If the optional name is not specified, the the pattern text itself is
used as the name.

Patterns are checked in the order given on the command line or in the
file. So, as soon as one of the patterns matches, the rest are ignored
at that stage. Recall that patterns can be applied multiple times on a

A file of patterns can contain blank lines. Comment lines that commence
with a ‚#‚ character are also ignored.

After processing command line arguments, pktstat then looks for and loads
.pktstatrc, $HOME/.pktstatrc and /etc/pktstatrc. (This behaviour is sup‚
pressed if the -A none option is given.)

Here are the contents of my .pktstatrc file:

dns @ udp *:domain <-> *
dns @ udp * <-> *:domain
irc @ udp <-> *

bpf(4), tcpdump(8)

David Leonard, [email protected]

DNS lookups can take too much time, possibly leading to missed packets.

The data rates do not take into account data link framing overhead or
compression savings at the data link layer.

The direction of traffic is not taken into account: both ingress and
egress data rates are combined. If you want to separate them, you will
need to use a filter expression.

Descriptive information for X11, FTP, HTTP and SUP flows is derived from
the very first packets sent on those protocols. If you start pktstat
after any of these flows have commenced, there may be no description
available for them.

BSD June 23, 2002 BSD