/
ifpps.8
139 lines (139 loc) · 4.82 KB
/
ifpps.8
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
.\" netsniff-ng - the packet sniffing beast
.\" Copyright 2013 Daniel Borkmann.
.\" Subject to the GPL, version 2.
.TH IFPPS 8 "03 March 2013" "Linux" "netsniff-ng toolkit"
.SH NAME
ifpps \- top-like networking and system statistics
.PP
.SH SYNOPSIS
.PP
\fBifpps\fR { [\fIoptions\fR] | [\fIdevice\fR] }
.PP
.SH DESCRIPTION
.PP
ifpps is a small utility which periodically provides top-like networking
and system statistics from the kernel. ifpps gathers its data directly
from procfs files and does not make use of any user space monitoring
libraries which would falsify statistics under high load.
.PP
For instance, consider the following scenario: two directly connected
Linux machines with Intel Core 2 Quad Q6600 2.40GHz CPUs, 4 GB RAM, and
an Intel 82566DC-2 Gigabit Ethernet NIC are used for performance evaluation.
One machine generates 64 byte network packets by using the kernel space
packet generator pktgen with a maximum possible packet rate. The other
machine displays statistics about incoming network packets by using i)
.BR iptraf (8)
and ii) ifpps.
.PP
iptraf which incorporates
.BR pcap (3)
shows an average packet rate of 246,000 pps while on the other hand ifpps shows
an average packet rate of 1,378,000 pps. Hence, due to packet copies and
deferring statistics creation into user space, a measurement error of
approximately 460 percent occurs. Tools like iptraf might display much more
information such as TCP per flow statistics (hence the use of the pcap library).
This is not possible with ifpps, because overall networking statistics are its
focus; statistics, which are also fairly reliable under high packet load.
.PP
ifpps also periodically displays CPU load, interrupt, software interrupt
data per sample interval as well as total interrupts, all per CPU. In case
the number of CPUs exceeds 5 or the number specified by the user with the
\fB-n\fP command line option, ifpps will only display this number top
heavy hitters. The topmost heavy hitter CPU will be marked with \[lq]+\[rq].
The least heavy hitter will always be displayed and is marked with
\[lq]-\[rq]. In addition, the average for all the above per-CPU data is
shown. Optionally the median values can be displayed using the \fB-m\fP
command line option.
.PP
ifpps also supports directly the
.BR gnuplot (1)
data sample format. This facilitates creation of gnuplot figures from ifpps time
series.
.PP
.SH OPTIONS
.TP
.B -d <netdev>, --dev <netdev>
Networking device to fetch statistics from, for example eth0, wlan0.
.TP
.B -n, --num-cpus
Set maximum number of top hitter CPUs (in terms of time spent in system/user
mode) to display in ncurses mode, default is 10.
.TP
.B -t <time>, --interval <time>
Statistics refresh interval in milliseconds, default is 1000ms.
.TP
.B -c, --csv
Output (once) the ncurses data to the terminal as
.BR gnuplot (1)-ready
data.
.TP
.B -l, --loop
Continuously output the terminal data after a refresh interval. This option
is only available if option \fB-c\fP is given. For \fB-l\fP it is
usually recommended to redirect the output into a file that is to be processed
later with
.BR gnuplot (1).
.TP
.B -m, --median
Show median values across all CPUs for CPU load, interrupts (per interval and
absolute) and software interrupts.
.TP
.B -o, --omit-header
Omit printing the CSV header. This option is only available if \fB-c\fP is given.
.TP
.B -p, --promisc
Turn on promiscuous mode for the given networking device.
.TP
.B -P, --percentage
Show percentage of current throughput in relation to theoretical line rate.
.TP
.B -W, --no-warn
Suppress possible warnings in the ncurses output, e.g. about a too low sampling
interval that could cause performance regression.
.TP
.B -v, --version
Show version information.
.TP
.B -h, --help
Show user help.
.PP
.SH USAGE EXAMPLE
.TP
.B ifpps eth0
Default ncurses output for the eth0 device.
.TP
.B ifpps -pd eth0
Ncurses output for the eth0 device in promiscuous mode.
.TP
.B ifpps -lpcd wlan0 > plot.dat
Continuous terminal output for the wlan0 device in promiscuous mode.
.PP
.SH NOTE
On 10Gbit/s cards or higher, receive and transmit statistics are usually
accumulated at a higher duration interval than 1 second. Thus, it might
be advisable to alter the timing to a higher accumulation interval for such cards.
.PP
.SH LEGAL
ifpps is licensed under the GNU GPL version 2.0.
.PP
.SH HISTORY
.B ifpps
was originally written for the netsniff-ng toolkit by Daniel Borkmann. It
is currently maintained by Tobias Klauser <tklauser@distanz.ch> and Daniel
Borkmann <dborkma@tik.ee.ethz.ch>.
.PP
.SH SEE ALSO
.BR netsniff-ng (8),
.BR trafgen (8),
.BR mausezahn (8),
.BR bpfc (8),
.BR flowtop (8),
.BR astraceroute (8),
.BR curvetun (8)
.PP
.SH AUTHOR
Manpage was written by Daniel Borkmann.
.PP
.SH COLOPHON
This page is part of the Linux netsniff-ng toolkit project. A description of the project,
and information about reporting bugs, can be found at http://netsniff-ng.org/.