NSTAT Linux command

Linux provides various tools that you can use to get the network statistics. One of the network statistics tools is the nstat command. You can easily view kernel SNMP counters and get network interface statistics with nstat.

The usual network statistics tool is netstat. However, nstat is handy and in some cases the best option over the other tools. Let’s see how nstat works.

The nstat command

The nstat tool retrieves network statistics and SNMP counters from two files, proc/net/netstat and proc/net/snmp. The format of the contents of the two files is not human readable and this is where the nstat command comes into play.

In most Linux distributions, the nstat command is provided by the iproute2 package. Also, it is nstat that provides the IP command in Linux systems.

How to use nstat

The syntax for using nstat is:

$ nstat [option] [pattern [ pattern]]

You can start by opening the help page to view the available options that you can use.

$ nstat -h

Show network statistics

You can view the network’s statistics by running the nstat command with no options. By default, the command calculates increments since last use and displays them in the output.

$ nstat

The output will be:

The above output and all information will be helpful depending on the circumstance. Let’s try to understand some of the information in the output.

  1. IpInReceives – the representation of all input datagrams, including those received from the interfaces in error. We can see that in our case the total number is 2697.
  2. TcpInSegs – the total number of segments received, including those with errors.
  3. TcpOutSegs – the number of segments sent, excluding those with only retransmitted octets.
  4. UdpInDatagrams – the total UDP datagrams delivered to all UDP users.

Any of this information is useful, and there are many options you can add to the command to tweak the output.

Basic nstat options

1. Output absolute counter values
Using the nstat command alone will display only the increments in statistics values ​​since the last use. However, you can output the absolute values ​​to add to the statistics with the -a option.

The new command is:

$ nstat -a

Note that the new network stats differ from those above in the output below. Also, using the -a option produces more information than nstat alone.

2. View update history
If you want to see the updated history of changes in network statistics, if any, without showing other output, use the -n option.

$ nstat -n

You can also choose not to update the history to view the accumulated counters with the -s option.

3. Show all statistics
If you use nstat, network parameters with null values ​​will not appear in the output, but that doesn’t restrict you from accessing them. The –-zero option includes the null values ​​in the output.

$ nstat – null

Our new edition will be:

The above output now contains network information with 0 numbers.

4. Reset history
We’ve seen how you can update or not update the history and use it in the next counters. You can sometimes choose to reset the historical stats and start over with analyzing the network stats. The -r option will help you with this.

$ nstat -r

The output now contains only the last counters.

5. Check version
Run the following command to quickly get the version information from nstat:


6. View network statistics in JSON format
You can use JSON format for output. All you have to do is add –json to the command.

$ nstat -json

netstat vs nstat – What is the difference?

Both nstat and netstat are network statistics tools. and they all cite the source of the information about the /proc files. The output when using netstat is more readable than that of nstat. Nonetheless, nstat shows all the raw metrics and information provided by the kernel, and its output is more compared to netstat

You also need to install net-tools to access the netstat command.

Let’s take a quick comparative example of the statistics provided by the two command line utilities.

For nstat the partial output is:

On the other hand, the output for netstat is:

netstat’s output is more readable, but both tools are useful nonetheless.


This guide introduced the nstat command and explained how you can use it to get network statistics. We’ve seen its syntax and common usage examples. While there are other network stats tools you can use, knowing how to use nstat is also a lifesaver.

Related Posts