nstat

nstat reads the same counters as netstat -s, but prints only the ones that changed and, by default, the delta since it last ran. It is the way to see effects the socket list cannot: how many SYN cookies the kernel sent under a flood (TcpExtSyncookiesSent), how many packets were dropped, how many segments were retransmitted. nstat -az prints every counter and resets, giving a clean baseline to measure against.

nstat command usage

nstat [-a] [-z] [PATTERN]

Options

-a

show all counters, not only the changed ones

-z

zero the counters after reading, for a fresh baseline

PATTERN

only counters whose name matches, e.g. TcpExtSyncookies

nstat examples

nstat -az TcpExtSyncookiesSent

Resets, then shows how many SYN cookies the kernel has sent.

nstat

Shows every counter that changed since the last run.

Pitfalls

• The default is the delta since nstat last ran on this device: run it once to set a baseline, then again to measure a window.

Run it on real machines