nicstat - the Solaris and Linux Network Monitoring Tool You Did Not Know You Needed

Update - Version 1.95, January 2014

Added "-U" option, to display separate read and write utilization. Simplified display code regarding "-M" option. For Solaris, fixed fetch64() to check type of kstats andf ixed memory leak in update_nicdata_list(). Full details at the entry for version 1.95

Update - Version 1.92, October 2012

Added "-M" option to display throughput in Mbps (Megabits per second). Fixed some bugs. Full details at the entry for version 1.92

Update - Version 1.90, July 2011

Many new features available, including extended NIC, TCP and UDP statistics. Full details at the entry for version 1.90

Update - February 2010

Nicstat now can produce parseable output if you add a "-p" flag. This is compatible with System Data Recorder (SDR). Links below are for the new version - 1.22.

Update - October 2009

Just a little one - nicstat now works on shared-ip Solaris zones.

Update - September 2009

OK, this is heading toward overkill...

The more I publish updates, the more I get requests for enhancement of nicstat. I have also decided to complete a few things that needed doing.

The improvements for this month are:

  • Added support for a "fd" or "hd" (in reality anything starting with an upper or lower-case F or H) suffix to the speed settings supplied via the "-S" option. This advises nicstat the interface is half-duplex or full-duplex. The Linux version now calculates %Util the same way as the Solaris version.
  • Added a script, enicstat, which uses ethtool to get speeds and duplex modes for all interfaces, then calls nicstat with an appropriate -S value.
  • Made the Linux version more efficient.
  • Combined the Solaris and Linux source into one nicstat.c. This is a little ugly due to #ifdef's, but that's the price you pay.
  • Wrote a man page.
  • Wrote better Makefile's for both platforms
  • Wrote a short README
  • Licensed nicstat under the Artistic License 2.0

All source and binaries will from now on be distributed in a tarball. This blog entry will remain the home of nicstat for the time being.

Lastly, I have heard the requests for easier availability in OpenSolaris. Stay tuned.

Update - August 2009

That's more like it - we should get plenty of coverage now :)

A colleague pointed out to me that nicstat's method of calculating utilization for a full-duplex interface is not correct.

Now nicstat will look for the kstat "link_duplex" value, and if it is 2 (which means full-duplex), it will use the greater of rbytes or wbytes to calculate utilization.

No change to the Linux version. Use the links in my previous post for downloading.

Update - July 2009

I should probably do this at least once a year, as nicstat needs more publicity...

A number of people have commented to me that nicstat always reports "0.00" for %Util on Linux. The reason for this is that there is no simple way an unprivileged user can get the speed of an interface in Linux (quite happy for someone to prove me wrong on that however).

Recently I got an offer of a patch from David Stone, to add an option to nicstat that tells it what the speed of an interface is. Pretty reasonable idea, so I have added it to the Linux version. You will see this new "-S" option explained if you use nicstat's "-h" (help) option.

I have made another change which makes nicstat more portable, hence easier to build on Linux.


A few years ago, a bloke I know by the name of Brendan Gregg wrote a Solaris kstat-based utility called nicstat. In 2006 I decided I needed to use this utility to capture network statistics in testing I do. Then I got a request from a colleague in PAE to do something about nicstat not being aware of "e1000g" interfaces.

I have spent a bit of time adding to nicstat since then, so I thought I would make the improved version available.

Why Should I Still Be Interested?

nicstat is to network interfaces as "iostat" is to disks, or "prstat" is to processes. It is designed as a much better version of "netstat -i". Its differences include:

  • Reports bytes in & out as well as packets.
  • Normalizes these values to per-second rates.
  • Reports on all interfaces (while iterating)
  • Reports Utilization (rough calculation as of now)
  • Reports Saturation (also rough)
  • Prefixes statistics with the current time

How about an example?

eac-t2000-3[bash]# nicstat 5
    Time      Int   rKB/s   wKB/s   rPk/s   wPk/s    rAvs    wAvs %Util    Sat
17:05:17      lo0    0.00    0.00    0.00    0.00    0.00    0.00  0.00   0.00
17:05:17  e1000g0    0.61    4.07    4.95    6.63   126.2   628.0  0.04   0.00
17:05:17  e1000g1   225.7   176.2   905.0   922.5   255.4   195.6  0.33   0.00
    Time      Int   rKB/s   wKB/s   rPk/s   wPk/s    rAvs    wAvs %Util    Sat
17:05:22      lo0    0.00    0.00    0.00    0.00    0.00    0.00  0.00   0.00
17:05:22  e1000g0    0.06    0.15    1.00    0.80   64.00   186.0  0.00   0.00
17:05:22  e1000g1    0.00    0.00    0.00    0.00    0.00    0.00  0.00   0.00
eac-t2000-3[bash]# nicstat -i e1000g0 5 4
    Time      Int   rKB/s   wKB/s   rPk/s   wPk/s    rAvs    wAvs %Util    Sat
17:08:49  e1000g0    0.61    4.07    4.95    6.63   126.2   628.0  0.04   0.00
17:08:54  e1000g0    0.06    0.04    1.00    0.20   64.00   186.0  0.00   0.00
17:08:59  e1000g0   239.2    2.33   174.4   33.60  1404.4   71.11  1.98   0.00
17:09:04  e1000g0    0.01    0.04    0.20    0.20   64.00   186.0  0.00   0.00

For more examples, see the man page.

References & Resources


"Lastly, I have heard the requests for easier availability in OpenSolaris. Stay tuned." - cool, I was thinking about submitting it via SourceJuicer myself but I will leave it to you then! :)

Posted by Robert Milkowski on September 15, 2009 at 10:16 PM PDT #

tim -

loving the nicstat possibilities, but it won't compile/install in a default Opensolaris 2009-06 (b 111b) image. Man I miss SXCE already.

Here's what else you need:

# pkg install SUNWhea
# pkg install ss-dev
(warning: ss-dev is a 285MB download)


And your readme rev 1.21 has the same 2 lines for the Solaris and Linux install syntax (typo). I think you should have a separate line for SPARC installs, because some of us use and love SPARC too.

Posted by svrocket on October 19, 2009 at 06:08 PM PDT #

This is now packaged at so it's easy to install with pkgutil for Solaris 8+ i386 and Sparc.

Posted by Peter Bonivart on October 28, 2009 at 08:28 PM PDT #

Is there a way to get Zone specific network performance measurements? We'd like to use this info to help us in sizing virtualized environments. read/write network packet/bytes per second usage for each zone.

Posted by andrew garcia on January 18, 2010 at 04:20 AM PST #


First of all thanks for the tool it's very nice.

Could be possible in the new version to add a flag that show the version of the binary.

Something like:
# nicstat -v


Posted by Jose Luis Barquín Guerola on January 26, 2010 at 11:08 PM PST #

thanks Tim. i will sync the changes to our
next version of SDR 0.73 due late this year.

Posted by Stefan Parvu on February 14, 2010 at 11:14 PM PST #

I can get statistic for interface:
nicstat -i bond0.999
Time Int rKB/s wKB/s rPk/s wPk/s rAvs wAvs %Util Sat
nicstat: no matching interface

but its interface work very well:
ifconfig bond0.999
bond0.999 Link encap:Ethernet HWaddr 00:21:5A:43:6D:7E
inet addr: Bcast: Mask:
inet6 addr: fe80::221:5aff:fe43:6d7e/64 Scope:Link
RX packets:80875 errors:0 dropped:0 overruns:0 frame:0
TX packets:34668 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:70761295 (67.4 MiB) TX bytes:5513666 (5.2 MiB)

my server have many interfaces:
145 pieces include alias.
It's bug?

Posted by zlo on March 25, 2010 at 07:17 PM PDT #

Thank you so much for this information

Posted by Gangadhar on October 07, 2010 at 09:37 AM PDT #

In some situation, cu does not allow to upload and download files to/from the SUT. I know there was a perl version of nicstat, the code can just be pasted to a text file opened in an editor like vi on the SUT. Thus, we can manage to use it. But the perl version is gone in the current release. Can you consider to add it in? Thanks.

Posted by guest on October 22, 2012 at 09:36 PM PDT #

Thanks a lot for providing information about this great tool for monitoring Network performance.
However, I see that the variables in Makefile are specifically for compiler "cc" and since Solaris Studio is not allowed we can't install it.
Is there an alternative way?

Posted by guest on March 07, 2014 at 11:28 AM PST #

If you are currently not able to use Solaris Studio you have three options - use one of the binaries I have provided on the sourceforge site, try compiling with another compiler, or get the "Solaris Studio is not allowed" policy changed. This is a misguided policy, particularly since Oracle Solaris Studio has been free for a number of years.

Posted by guest on March 07, 2014 at 12:02 PM PST #

having trouble building this on latest S11.
1. root@varan:/home/airoot/nicstat-1.95# make
gcc -g -D_REENTRANT `./ def` -o nicstat nicstat.c -lsocket -lkstat -lrt `./ lib`
gcc: unrecognized option '-zlazyload'

2. pfexec /usr/sbin/install -u root -g bin `./ --bin-name` /usr/local/bin/nicstat
new owner is root
find: stat() error /usr/local/bin/nicstat: No such file or directory
find: cycle detected for /lib/crypto/32/
find: cycle detected for /lib/secure/32/
find: cycle detected for /lib/32/
find: cycle detected for /usr/lib/secure/32/
find: cycle detected for /usr/lib/locale/en_US.UTF-8/LO_LTYPE/32/
find: cycle detected for /usr/lib/locale/en_US.UTF-8/LC_CTYPE/32/
find: cycle detected for /usr/lib/locale/en_US.UTF-8/32/
find: cycle detected for /usr/lib/security/32/
find: cycle detected for /usr/lib/lwp/32/
find: cycle detected for /usr/lib/fm/topo/plugins/32/
find: cycle detected for /usr/lib/elfedit/32/
find: cycle detected for /usr/lib/link_audit/32/
find: cycle detected for /usr/lib/32/
install: .nicstat.Solaris_11_sparc was not found anywhere!
*** Error code 2
make: Fatal error: Command failed for target `install_native'

Which is weird because the per-compiled binary is in there, and works. Moreover make isn't detecting it and tries to recompile it every time, and fails.

What is your development environment?

Posted by Mr. Chuck on March 10, 2014 at 10:41 PM PDT #

Chuck, you should certainly end up in the weeds if you try using GCC on Solaris, as it does not know about '-zlazyload' (which is a linker option, BTW). I will put my foot down and say I only support Solaris Studio as the compiler for nicstat on Solaris. Petulant you might say, but perhaps I am trying to increase the user base for Solaris Studio, now that there is no revenue stream :)

Posted by guest on March 10, 2014 at 11:21 PM PDT #

Post a Comment:
  • HTML Syntax: NOT allowed

Tim Cook's Weblog The views expressed on this blog are my own and do not necessarily reflect the views of Oracle.


« June 2016