nicstat - the Solaris and Linux Network Monitoring Tool You Did Not Know You Needed

Update - Version 1.95, January 2014

Added "-U" option, to display separate read and write utilization. Simplified display code regarding "-M" option.
For Solaris, fixed fetch64() to check type of kstats andf ixed memory leak in update_nicdata_list(). Full details at the entry for version 1.95

Update - Version 1.92, October 2012

Added "-M" option to display throughput in Mbps (Megabits per second). Fixed some bugs. Full details at the entry for version 1.92

Update - Version 1.90, July 2011

Many new features available, including extended NIC, TCP and UDP statistics. Full details at the entry for version 1.90

Update - February 2010

Nicstat now can produce parseable output if you add a "-p" flag.
This is compatible with
System Data Recorder (SDR)
Links below are for the new version - 1.22.

Update - October 2009

Just a little one - nicstat now works on shared-ip Solaris zones.

Update - September 2009

OK, this is heading toward overkill...

The more I publish updates, the more I get requests for
enhancement of nicstat. I have also decided to complete a few things
that needed doing.

The improvements for this month are:

  • Added support for a "fd" or "hd" (in reality anything starting
    with an upper or lower-case F or H) suffix to the speed settings
    supplied via the "-S" option. This advises nicstat the interface
    is half-duplex or full-duplex. The Linux version now calculates
    %Util the same way as the Solaris version.
  • Added a script, enicstat, which uses ethtool to get
    speeds and duplex modes for all interfaces, then calls nicstat
    with an appropriate -S value.
  • Made the Linux version more efficient.
  • Combined the Solaris and Linux source into one nicstat.c.
    This is a little ugly due to #ifdef's, but that's the price you pay.
  • Wrote a man page.
  • Wrote better Makefile's for both platforms
  • Wrote a short README
  • Licensed nicstat under the Artistic License 2.0

All source and binaries will from now on be distributed in a tarball.
This blog entry will remain the home of nicstat for the time

Lastly, I have heard the requests for easier availability in
OpenSolaris. Stay tuned.

Update - August 2009

That's more like it - we should get plenty of coverage now :)

A colleague pointed out to me that nicstat's method of calculating
utilization for a full-duplex interface is not correct.

Now nicstat will look for the kstat "link_duplex" value, and if it is 2 (which means full-duplex),
it will use the greater of rbytes or wbytes to calculate utilization.

No change to the Linux version. Use the links in my previous post for downloading.

Update - July 2009

I should probably do this at least once a year, as nicstat needs
more publicity...

A number of people have commented to me that nicstat always reports
"0.00" for %Util on Linux. The reason for this is that there is no
simple way an unprivileged user can get the speed of an interface in
Linux (quite happy for someone to prove me wrong on that however).

Recently I got an offer of a patch from David Stone, to add an option
to nicstat that tells it what the speed of an interface is. Pretty
reasonable idea, so I have added it to the Linux version. You will
see this new "-S" option explained if you use nicstat's "-h" (help)

I have made another change which makes nicstat more portable, hence
easier to build on Linux.


A few years ago, a bloke I know by the name of Brendan Gregg wrote a
Solaris kstat-based utility called nicstat. In 2006 I decided I
needed to use this utility to capture network statistics in testing I
do. Then I got a request from a colleague in PAE to do something
about nicstat not being aware of "e1000g" interfaces.

I have spent a bit of time adding to nicstat since then, so I thought
I would make the improved version available.

Why Should I Still Be Interested?

nicstat is to network interfaces as "iostat" is to disks, or "prstat"
is to processes. It is designed as a much better version of "netstat
-i". Its differences include:

  • Reports bytes in & out as well as packets.
  • Normalizes these values to per-second rates.
  • Reports on all interfaces (while iterating)
  • Reports Utilization (rough calculation as of now)
  • Reports Saturation (also rough)
  • Prefixes statistics with the current time

How about an example?

eac-t2000-3[bash]# nicstat 5
Time Int rKB/s wKB/s rPk/s wPk/s rAvs wAvs %Util Sat
17:05:17 lo0 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00
17:05:17 e1000g0 0.61 4.07 4.95 6.63 126.2 628.0 0.04 0.00
17:05:17 e1000g1 225.7 176.2 905.0 922.5 255.4 195.6 0.33 0.00
Time Int rKB/s wKB/s rPk/s wPk/s rAvs wAvs %Util Sat
17:05:22 lo0 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00
17:05:22 e1000g0 0.06 0.15 1.00 0.80 64.00 186.0 0.00 0.00
17:05:22 e1000g1 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00
eac-t2000-3[bash]# nicstat -i e1000g0 5 4
Time Int rKB/s wKB/s rPk/s wPk/s rAvs wAvs %Util Sat
17:08:49 e1000g0 0.61 4.07 4.95 6.63 126.2 628.0 0.04 0.00
17:08:54 e1000g0 0.06 0.04 1.00 0.20 64.00 186.0 0.00 0.00
17:08:59 e1000g0 239.2 2.33 174.4 33.60 1404.4 71.11 1.98 0.00
17:09:04 e1000g0 0.01 0.04 0.20 0.20 64.00 186.0 0.00 0.00

For more examples, see the man page.

References & Resources

Join the discussion

Comments ( 13 )
  • Robert Milkowski Wednesday, September 16, 2009

    "Lastly, I have heard the requests for easier availability in OpenSolaris. Stay tuned." - cool, I was thinking about submitting it via SourceJuicer myself but I will leave it to you then! :)

  • svrocket Tuesday, October 20, 2009

    tim -

    loving the nicstat possibilities, but it won't compile/install in a default Opensolaris 2009-06 (b 111b) image. Man I miss SXCE already.

    Here's what else you need:

    # pkg install SUNWhea

    # pkg install ss-dev

    (warning: ss-dev is a 285MB download)



    And your readme rev 1.21 has the same 2 lines for the Solaris and Linux install syntax (typo). I think you should have a separate line for SPARC installs, because some of us use and love SPARC too.

  • Peter Bonivart Thursday, October 29, 2009

    This is now packaged at www.opencsw.org so it's easy to install with pkgutil for Solaris 8+ i386 and Sparc.

  • andrew garcia Monday, January 18, 2010

    Is there a way to get Zone specific network performance measurements? We'd like to use this info to help us in sizing virtualized environments. read/write network packet/bytes per second usage for each zone.

  • Jose Luis Barquín Guerola Wednesday, January 27, 2010


    First of all thanks for the tool it's very nice.

    Could be possible in the new version to add a flag that show the version of the binary.

    Something like:

    # nicstat -v



  • Stefan Parvu Monday, February 15, 2010

    thanks Tim. i will sync the changes to our

    next version of SDR 0.73 due late this year.

  • zlo Friday, March 26, 2010


    I can get statistic for interface:

    nicstat -i bond0.999

    Time Int rKB/s wKB/s rPk/s wPk/s rAvs wAvs %Util Sat

    nicstat: no matching interface

    but its interface work very well:

    ifconfig bond0.999

    bond0.999 Link encap:Ethernet HWaddr 00:21:5A:43:6D:7E

    inet addr: Bcast: Mask:

    inet6 addr: fe80::221:5aff:fe43:6d7e/64 Scope:Link


    RX packets:80875 errors:0 dropped:0 overruns:0 frame:0

    TX packets:34668 errors:0 dropped:0 overruns:0 carrier:0

    collisions:0 txqueuelen:0

    RX bytes:70761295 (67.4 MiB) TX bytes:5513666 (5.2 MiB)

    my server have many interfaces:

    145 pieces include alias.

    It's bug?

  • Gangadhar Thursday, October 7, 2010

    Thank you so much for this information

  • guest Tuesday, October 23, 2012

    In some situation, cu does not allow to upload and download files to/from the SUT. I know there was a perl version of nicstat, the code can just be pasted to a text file opened in an editor like vi on the SUT. Thus, we can manage to use it. But the perl version is gone in the current release. Can you consider to add it in? Thanks.

  • guest Friday, March 7, 2014

    Thanks a lot for providing information about this great tool for monitoring Network performance.

    However, I see that the variables in Makefile are specifically for compiler "cc" and since Solaris Studio is not allowed we can't install it.

    Is there an alternative way?

  • guest Friday, March 7, 2014

    If you are currently not able to use Solaris Studio you have three options - use one of the binaries I have provided on the sourceforge site, try compiling with another compiler, or get the "Solaris Studio is not allowed" policy changed. This is a misguided policy, particularly since Oracle Solaris Studio has been free for a number of years.

  • Mr. Chuck Tuesday, March 11, 2014

    having trouble building this on latest S11.

    1. root@varan:/home/airoot/nicstat-1.95# make

    gcc -g -D_REENTRANT `./dladm.sh def` -o nicstat nicstat.c -lsocket -lkstat -lrt `./dladm.sh lib`

    gcc: unrecognized option '-zlazyload'

    2. pfexec /usr/sbin/install -u root -g bin `./nicstat.sh --bin-name` /usr/local/bin/nicstat

    new owner is root

    find: stat() error /usr/local/bin/nicstat: No such file or directory

    find: cycle detected for /lib/crypto/32/

    find: cycle detected for /lib/secure/32/

    find: cycle detected for /lib/32/

    find: cycle detected for /usr/lib/secure/32/

    find: cycle detected for /usr/lib/locale/en_US.UTF-8/LO_LTYPE/32/

    find: cycle detected for /usr/lib/locale/en_US.UTF-8/LC_CTYPE/32/

    find: cycle detected for /usr/lib/locale/en_US.UTF-8/32/

    find: cycle detected for /usr/lib/security/32/

    find: cycle detected for /usr/lib/lwp/32/

    find: cycle detected for /usr/lib/fm/topo/plugins/32/

    find: cycle detected for /usr/lib/elfedit/32/

    find: cycle detected for /usr/lib/link_audit/32/

    find: cycle detected for /usr/lib/32/

    install: .nicstat.Solaris_11_sparc was not found anywhere!

    *** Error code 2

    make: Fatal error: Command failed for target `install_native'

    Which is weird because the per-compiled binary is in there, and works. Moreover make isn't detecting it and tries to recompile it every time, and fails.

    What is your development environment?

  • guest Tuesday, March 11, 2014

    Chuck, you should certainly end up in the weeds if you try using GCC on Solaris, as it does not know about '-zlazyload' (which is a linker option, BTW). I will put my foot down and say I only support Solaris Studio as the compiler for nicstat on Solaris. Petulant you might say, but perhaps I am trying to increase the user base for Solaris Studio, now that there is no revenue stream :)

Please enter your name.Please provide a valid email address.Please enter a comment.CAPTCHA challenge response provided was incorrect. Please try again.Captcha

Integrated Cloud Applications & Platform Services