ipfstat(8)ipfstat(8)NAMEipfstat - reports on packet filter statistics and filter list
SYNOPSISipfstat [ -6aAfghIinosv ] [ -d <device> ]
ipfstat-t [ -C ] [ -D <addrport> ] [ -P <protocol> ] [ -S <addrport> ]
[ -T <refresh time> ] [ -d <device> ]
DESCRIPTIONipfstat examines /dev/kmem using the symbols _fr_flags, _frstats, _fil‐
terin, and _filterout. To run and work, it needs to be able to read
both /dev/kmem and the kernel itself. The kernel name defaults to
/kernel.
The default behaviour of ipfstat is to retrieve and display the accumu‐
lated statistics which have been accumulated over time as the kernel
has put packets through the filter.
OPTIONS-6 Display filter lists for IPv6, if available.
-a Display the accounting filter list and show bytes counted
against each rule.
-A Display packet authentication statistics.
-C This option is only valid in combination with -t. Display
"closed" states as well in the top. Normally, a TCP connection
is not displayed when it reaches the CLOSE_WAIT protocol state.
With this option enabled, all state entries are displayed.
-d <device>
Use a device other than /dev/ipl for interfacing with the ker‐
nel.
-D <addrport>
This option is only valid in combination with -t. Limit the
state top display to show only state entries whose destination
IP address and port match the addport argument. The addrport
specification is of the form ipaddress[,port]. The ipaddress
and port should be either numerical or the string "any" (speci‐
fying any IP address resp. any port). If the -D option is not
specified, it defaults to "-D any,any".
-f Show fragment state information (statistics) and held state
information (in the kernel) if any is present.
-g Show groups currently configured (both active and inactive).
-h Show per-rule the number of times each one scores a "hit". For
use in combination with -i.
-i Display the filter list used for the input side of the kernel IP
processing.
-I Swap between retrieving "inactive"/"active" filter list details.
For use in combination with -i.
-n Show the "rule number" for each rule as it is printed.
-o Display the filter list used for the output side of the kernel
IP processing.
-P <protocol>
This option is only valid in combination with -t. Limit the
state top display to show only state entries that match a spe‐
cific protocol. The argument can be a protocol name (as defined
in /etc/protocols) or a protocol number. If this option is not
specified, state entries for any protocol are specified.
-s Show packet/flow state information (statistics only).
-sl Show held state information (in the kernel) if any is present
(no statistics).
-S <addrport>
This option is only valid in combination with -t. Limit the
state top display to show only state entries whose source IP
address and port match the addport argument. The addrport speci‐
fication is of the form ipaddress[,port]. The ipaddress and
port should be either numerical or the string "any" (specifying
any ip address resp. any port). If the -S option is not speci‐
fied, it defaults to "-S any,any".
-t Show the state table in a way similar to they way top(1) shows
the process table. States can be sorted using a number of dif‐
ferent ways. This options requires ncurses(3) and needs to be
compiled in. It may not be available on all operating systems.
See below, for more information on the keys that can be used
while ipfstat is in top mode.
-T <refreshtime>
This option is only valid in combination with -t. Specifies how
often the state top display should be updated. The refresh time
is the number of seconds between an update. Any positive integer
can be used. The default (and minimal update time) is 1.
-v Turn verbose mode on. Displays more debugging information.
SYNOPSIS
The role of ipfstat is to display current kernel statistics gathered as
a result of applying the filters in place (if any) to packets going in
and out of the kernel. This is the default operation when no command
line parameters are present.
When supplied with either -i or -o, it will retrieve and display the
appropriate list of filter rules currently installed and in use by the
kernel.
STATE TOP
Using the -t option ipfstat will enter the state top mode. In this mode
the state table is displayed similar to the way top displays the
process table. The -C, -D, -P, -S and -T command line options can be
used to restrict the state entries that will be shown and to specify
the frequency of display updates.
In state top mode, the following keys can be used to influence the dis‐
played information:
d select information to display.
l redraw the screen.
q quit the program.
s switch between different sorting criterion.
r reverse the sorting criterion.
States can be sorted by protocol number, by number of IP packets, by
number of bytes and by time-to-live of the state entry. The default is
to sort by the number of bytes. States are sorted in descending order,
but you can use the r key to sort them in ascending order.
STATE TOP LIMITATIONS
It is currently not possible to interactively change the source, desti‐
nation and protocol filters or the refresh frequency. This must be done
from the command line.
The screen must have at least 80 columns. This is however not checked.
Only the first X-5 entries that match the sort and filter criteria are
displayed (where X is the number of rows on the display. There is no
way to see more entries.
No support for IPv6
FILES
/dev/kmem
/dev/ipl
/dev/ipstate
/kernel
SEE ALSOipf(8)BUGS
none known.
ipfstat(8)
