Section 7.2. Packets Are Not Bytes

7.2. Packets Are Not Bytes

The official tool in Solaris for monitoring network traffic is the netstat command.

$ netstat -i 1     input   hme0      output           input  (Total)    output packets errs  packets errs  colls  packets errs  packets errs  colls 141461153 29    152961282 0     0      234608752 29    246108881 0     0 295     0     2192    0     0      299     0     2196    0      0 296     0     2253    0     0      300     0     2257    0      0 295     0     2258    0     0      299     0     2262    0      0 179     0     1305    0     0      183     0     1309    0      0 ... 

In the above output, we can see that the hme0 interface had very few errors (which is useful to know) and was sending over 2,000 packets per second. Is 2, 000a lot? We don't know whether this means the interface is at 100% utilization or 1% utilization; all it tells us is that traffic is occurring.

Measuring traffic by using packet counts is like measuring rainfall by listening for rain. Network cards are rated in terms of throughput, 100 Mbits/sec, 1000 Mbits/sec, etc. Measuring the current network traffic in similar terms (by using bytes) helps us understand how utilized the interface really is.

Bytes per second are indeed tracked by Kstat, and netstat is a Kstat consumer. However, netstat doesn't surrender this information without a fight.^[2] These days we are supposed to use kstat to get it.

^[2] The secret -k option that dumped all kstats has been dropped in Solaris 10 anyway.

$ kstat -p 'hme:0:hme0:*bytes64' hme:0:hme0:obytes64     51899673435 hme:0:hme0:rbytes64     47536009231 

This output shows that byte statistics for network interfaces are indeed in Kstat, which will let us calculate a percent utilization. Later, we cover tools that help us do that. For now we discuss why network utilization, saturation, and errors are useful metrics to observe.