PKTSTAT(1)

💖 pktstat(1) — general commands manual, but make it cute 💖

okay bestie, so pktstat is a General Commands Manual page (section 1, iykyk) and it's here to show you packet activity on a crt. yes, a crt. retro king behavior. let's get into it ✨

---

🌸 SYNOPSIS 🌸

pktstat [-1BcFlnpPtT] [-a abbrev] [-A file] [-i interface] [-k keeptime]
        [-m maxbps] [-w waittime] [filter-expr]

---

✨ DESCRIPTION ✨

So like, pktstat shows you a real-time summary of packet activity on an interface. Every line = the data rate for a different class of packets. it's giving "watching the vibes flow in live" 🦋

pktstat understands these command line options, and yes we're doing all of them, no skipping:

• -1 — Single-shot (batch) mode. pktstat collects data for waittime seconds (peep the -w option) and then emits a line telling you how many flows it detected and how long it captured data for (in seconds). Then each flow line gets printed as: the number of data link octets for that flow, then the number of data link frames (packets), then the flow description. one and done, no notes 💅
• -a abbrev — Add abbrev to the list of abbreviation patterns. (details are further down, keep reading bestie)
• -A file — Read abbreviation patterns from the given file. (see "Abbreviations" below.) And heads up: if you pass -A none, the default abbreviation files do not get loaded. sneaky but important 🙈
• -B — Display data rates in bytes per second (Bps) instead of bits per second (bps). capital B matters, babe.
• -c — Do not combine some packet classes into one class. Like, TCP connections stay as two separate flows. no merging, everyone gets their own seat 🎀
• -F — Show full hostnames. Normally hostnames get truncated down to just the first component of their domain name before display.
• -i interface — Listen on the given interface. If you don't specify one, a suitable interface is chosen for you. it's autonomous like that 👑
• -k keeptime — When no packets have been seen for a particular class, keep an entry on the display for this many screen seconds. Defaults to 10.
• -l — Display and sort flows by when they were last seen. (Incompatible with -t — they do NOT get along, pick a lane 💀)
• -m maxbps — Fix the maximum bit rate for the interface at maxbps instead of auto-detecting it.
• -n — Do not try and resolve hostnames or service port numbers. raw and unfiltered fr fr.
• -p — Show packet counts instead of bit counts.
• -P — Do not try to put the interface into promiscuous mode. (it's keeping things exclusive 😌)
• -t — "Top" mode. Sorts the display by bit count (or by packet count if -p was given) instead of by the name.
• -T — Show totals.
• -w waittime — Refresh the display every waittime seconds. Default is 5 seconds.
• filter-expr — Only consider packets matching the given filter-expr. If you don't give a filter, all packets are considered. See tcpdump(8) for info on what expressions are valid.

If your terminal supports it, the display briefly highlights in bold new connections, or old connections carrying data after a period of inactivity. it's the little glow-up moment ✨

Simple statistics about the interface are also displayed, like the current and average bit rates (measured just above the data link layer). Load averages = bit rate decayed averages for the last 1, 5 and 15 minutes.

---

🎀 keystrokes it recognises while displaying 🎀

• q — quit
• Ctrl-L — redraw screen
• t — toggle the -t flag (top mode)
• T — toggle the -T flag (totals mode)
• w — allows changing of the -w flag value (wait time)
• n — toggle the -n flag (numeric display)
• p — toggle the -p flag (packets instead of bits)
• b | B — toggle the -B flag (bps or Bps)
• f | F — toggle the -F flag (full hostnames)
• r — reset collected statistics (min, max, etc.), flush flow history and reset DNS/service and fragment caches
• l — show and sort flows by when they were last active
• ? — toggle display of help/status text at the bottom of the display

---

🦋 Packet classes 🦋

All packet classes, aka flows, are "tagged" with a descriptive string, like ‘tcp ftpserver:20524 <-> cathexis:17771’. cute little name tag 🏷️

On top of being tagged, some protocol-state info can be associated with a flow. That gets displayed immediately below a flow line. Descriptive info for FTP, HTTP, X11 and SUP connections is figured out from simple decoding of some packets. If the connection is 'open', it's introduced with a right angle shape (+), otherwise it's introduced with a hyphen character.

tcp www:80 <-> hamartia:19179
+ GET /index.html

---

💜 Abbreviations 💜

Abbreviation patterns are a way of further combining flows. As packets get decoded, their flow name is constructed at the various protocol layers. At address combining stage (where arrows like ‘->’ get inserted) and at the final display stage, flow names get checked against a list of abbreviation patterns, and the abbreviation's name gets substituted if a match is found. For example, the pattern ‘* <-> *:domain’ will match DNS packets in both the UDP and TCP layers. slay, one pattern, two layers 💅

Abbreviations take the form [abbrev@]pattern. The pattern part can contain the wildcard character, asterisk ‘*’, which matches zero or more non-space characters. The space character matches one or more whitespace characters. Leading and trailing spaces are ignored.

If the optional abbrev isn't specified, then the pattern text itself is used as the abbreviation. (yes the original says "the the", we're not fixing it, we're respecting it 🫶)

Patterns are checked in the order given on the command line or in the files — i.e. as soon as one of the patterns matches a tag, no further patterns are considered. And remember: patterns can be applied multiple times to a tag.

A patterns file can contain blank lines, which get ignored. Comment lines that start with a ‘#’ character are also ignored.

After processing all command line abbreviations and abbreviation files, pktstat looks for and loads the files .pktstatrc, $HOME/.pktstatrc and /etc/pktstatrc. This behavior is suppressed by supplying an -A none option. main character energy, loading its own config 😌

---

🌈 EXAMPLES 🌈

Here's the contents of my .pktstatrc file:

dns @ udp *:domain <-> *
dns @ udp * <-> *:domain
irc @ udp 192.168.0.81:6666 <-> *

---

⭐ SEE ALSO ⭐

bpf(4), tcpdump(8)

---

👑 AUTHORS 👑

David Leonard, leonard@users.sourceforge.net — king behavior, honestly

---

💀 BUGS 💀

DNS lookups can take too much time, possibly leading to missed packets. (not me waiting on DNS while the packets just leave without me 😭)

The data rates do not take into account data link framing overhead or compression savings at the data link layer.

The direction of traffic is not taken into account: both ingress and egress data rates are combined. If you want to separate them, you'll need to use a filter expression.

Descriptive information for X11, FTP, HTTP and SUP flows is derived from the very first packets sent on those protocols. If you start pktstat after any of these flows have commenced, there may be no description available for them. FOMO but for packets 🙈

---

k bye bestie, this page is from the Debian build, dated June 23, 2002, and it's PKTSTAT(1) — go watch some packets, you got this 💖✨