.\" netsniff-ng - the packet sniffing beast .\" Copyright 2013 Daniel Borkmann. .\" Subject to the GPL, version 2. .TH IFPPS 8 "03 March 2013" "Linux" "netsniff-ng toolkit" .SH NAME ifpps \- top-like networking and system statistics .PP .SH SYNOPSIS .PP \fBifpps\fR { [\fIoptions\fR] | [\fIdevice\fR] } .PP .SH DESCRIPTION .PP ifpps is a small utility which periodically provides top-like networking and system statistics from the kernel. ifpps gathers its data directly from procfs files and does not make use of any user space monitoring libraries which would falsify statistics under high load. .PP For instance, consider the following scenario: two directly connected Linux machines with Intel Core 2 Quad Q6600 2.40GHz CPUs, 4 GB RAM, and an Intel 82566DC-2 Gigabit Ethernet NIC are used for performance evaluation. One machine generates 64 byte network packets by using the kernel space packet generator pktgen with a maximum possible packet rate. The other machine displays statistics about incoming network packets by using i) .BR iptraf (8) and ii) ifpps. .PP iptraf which incorporates .BR pcap (3) shows an average packet rate of 246,000 pps while on the other hand ifpps shows an average packet rate of 1,378,000 pps. Hence, due to packet copies and deferring statistics creation into user space, a measurement error of approximately 460 percent occurs. Tools like iptraf might display much more information such as TCP per flow statistics (hence the use of the pcap library). This is not possible with ifpps, because overall networking statistics are its focus; statistics, which are also fairly reliable under high packet load. .PP ifpps also periodically displays CPU load, interrupt, software interrupt data per sample interval as well as total interrupts, all per CPU. In case the number of CPUs exceeds 5 or the number specified by the user with the \fB-n\fP command line option, ifpps will only display this number top heavy hitters. The topmost heavy hitter CPU will be marked with \[lq]+\[rq]. The least heavy hitter will always be displayed and is marked with \[lq]-\[rq]. In addition, the average for all the above per-CPU data is shown. Optionally the median values can be displayed using the \fB-m\fP command line option. .PP ifpps also supports directly the .BR gnuplot (1) data sample format. This facilitates creation of gnuplot figures from ifpps time series. .PP .SH OPTIONS .TP .B -d , --dev Networking device to fetch statistics from, for example eth0, wlan0. .TP .B -n, --num-cpus Set maximum number of top hitter CPUs (in terms of time spent in system/user mode) to display in ncurses mode, default is 10. .TP .B -t