IFPPS(8)

💖 ifpps — bestie's fave top-like networking & system stats 💖

okay so this is ifpps(8), part of the netsniff-ng toolkit, and it's literally the coolest little utility ever. it's giving main character energy in the kernel stats department. sit down, grab a boba, we're doing this. 🧋✨

---

🌸 SYNOPSIS 🌸

ifpps { [options] | [device] }

that's it. that's the whole vibe. options or a device, pick your fighter. 💅

---

✨ DESCRIPTION ✨

okay so ifpps is this small utility that periodically hands you top-like networking and system statistics, straight from the kernel. and the way it does it?? it gathers its data directly from procfs files and does not use any user space monitoring libraries. which matters, bestie, because those libraries would falsify your statistics under high load. no cap. 🙅♀️

let me paint you a picture, because the original example is iconic:

imagine two directly connected Linux machines with Intel Core 2 Quad Q6600 2.40GHz CPUs, 4 GB RAM, and an Intel 82566DC-2 Gigabit Ethernet NIC, all set up for performance evaluation. one machine generates 64 byte network packets using the kernel space packet generator pktgen at the maximum possible packet rate. the other machine displays stats about incoming network packets using i) iptraf(8) and ii) ifpps.

so iptraf, which incorporates pcap(3), shows an average packet rate of 246,000 pps. meanwhile ifpps shows an average packet rate of 1,378,000 pps. 😭 that's a measurement error of approximately 460 percent, all because of packet copies and deferring statistics creation into user space. and yeah, tools like iptraf might show you way more info, like TCP per flow statistics (hence the whole pcap library situation). but that's just not possible with ifpps, because overall networking statistics are its focus — statistics that are also, importantly, fairly reliable under high packet load. slay. 💅

also!! ifpps periodically displays CPU load, interrupt, software interrupt data per sample interval, plus total interrupts — all per CPU. 🫶

here's the part where it gets ✨selective✨: if the number of CPUs exceeds 5, or exceeds the number you specified with the -n command line option, ifpps will only display that number of top heavy hitters. and get this:

• the topmost heavy hitter CPU gets marked with +
• the least heavy hitter is always displayed and gets marked with -

plus, the average for all the above per-CPU data is shown. and optionally you can see the median values using the -m command line option. obsessed. 😌

oh and one more thing — ifpps also directly supports the gnuplot(1) data sample format. which makes creating gnuplot figures from ifpps time series super easy. 🌈

---

💅 OPTIONS 💅

• -d <netdev>, --dev <netdev> — networking device to fetch statistics from. like eth0, wlan0. you know the drill. 🎀
• -n, --num-cpus — set the maximum number of top hitter CPUs (in terms of time spent in system/user mode) to display in ncurses mode. default is 10.
• -t <time>, --interval <time> — statistics refresh interval in milliseconds. default is 1000ms.
• -c, --csv — output (once) the ncurses data to the terminal as gnuplot(1)-ready data. 📊
• -l, --loop — continuously output the terminal data after a refresh interval. ⚠️ this option is only available if option -c is given. and for -l it's usually recommended to redirect the output into a file that's gonna be processed later with gnuplot(1).
• -m, --median — show median values across all CPUs for CPU load, interrupts (per interval and absolute) and software interrupts.
• -o, --omit-header — omit printing the CSV header. ⚠️ this option is only available if -c is given.
• -p, --promisc — turn on promiscuous mode for the given networking device. 👀
• -P, --percentage — show percentage of current throughput in relation to theoretical line rate.
• -W, --no-warn — suppress possible warnings in the ncurses output. like, for example, a warning about a too low sampling interval that could cause performance regression.
• -v, --version — show version information.
• -h, --help — show user help. 🫶

---

🦋 USAGE EXAMPLE 🦋

ifpps eth0

default ncurses output for the eth0 device. classic. 💖

ifpps -pd eth0

ncurses output for the eth0 device in promiscuous mode. 👑

ifpps -lpcd wlan0 > plot.dat

continuous terminal output for the wlan0 device in promiscuous mode. ✨

---

⭐ NOTE ⭐

on 10Gbit/s cards or higher, receive and transmit statistics are usually accumulated at a higher duration interval than 1 second. so like, it might be advisable to alter the timing to a higher accumulation interval for such cards. bestie with the fancy NIC, this one's for you. 🙈

---

👑 LEGAL 👑

ifpps is licensed under the GNU GPL version 2.0. periodt.

---

🌸 HISTORY 🌸

ifpps was originally written for the netsniff-ng toolkit by Daniel Borkmann. it is currently maintained by Tobias Klauser <tklauser@distanz.ch> and Daniel Borkmann <dborkma@tik.ee.ethz.ch>. legends only. 🫶

---

🔥 SEE ALSO 🔥

netsniff-ng(8), trafgen(8), mausezahn(8), bpfc(8), flowtop(8), astraceroute(8), curvetun(8)

the whole squad. go read them, iykyk. 💜

---

🎀 AUTHOR 🎀

manpage was written by Daniel Borkmann. 💖

---

🌈 COLOPHON 🌈

this page is part of the Linux netsniff-ng toolkit project. a description of the project, and information about reporting bugs, can be found at http://netsniff-ng.org/.

---

okay that's the whole thing bestie, you're officially an ifpps girlie now 💅✨ this page is from the Linux manual set, dated 03 March 2013, filed under IFPPS(8). go forth and measure some packets, no cap. 🦋💖