pfstat(1) [osf1 man page]

pfstat(1)						      General Commands Manual							 pfstat(1)

NAME

       pfstat - Print packet filter status information

SYNOPSIS

       /usr/bin/pfstat [options]

OPTIONS

       If no options are given, all are assumed (except for the verbose option, -v).  Counts.  Displays various counts (per ethernet unit) includ-
       ing number of packets sent and received, the number of packets dropped due to full input queues, the number of packets not  wanted  by  any
       filter,	and  the number of packets missed by the interface.  Descriptors.  Displays OpenDescriptors for each minor device.  Filters.  Dis-
       plays packet filters for each minor device.  Parameters.  Displays device parameters including device type,  header  and  address  lengths,
       maximum transmission units (MTU), and interface and broadcast addresses.  QueueElements.  Displays the QueueElements.  Scavenger.  Displays
       the FreeQueue and Scavenger statistics.	Verbose.  Displays information for minor devices not actually in use and complete  queue  informa-
       tion,  only if this option is given.  Limits output to information about specified units.  If no digits are given, all units are displayed.
       Valid digits are 0 to 7.

DESCRIPTION

       The pfstat command interprets the data structures of the packet filter driver  packetfilter(7).	 The  data  structures	are  contained	in
       /dev/kmem.

RESTRICTIONS

       By  default,  some  of  the output might not be easily read on an 80-character line.  You might want to use some of the options to obtain a
       less verbose but more readable listing.

       Because of the dynamic nature of a running system, pfstat might not provide a consistent view of the system.  You should use  this  command
       for analyzing static or slowly-varying problems, not transient ones.

OUTPUT FORMAT

       This  section  describes  the  information  displayed  in  the output of the pfstat command under the headings AllDescriptors, Filters, and
       QueueElts.

   AllDescriptors
       Minor device number for open descriptor.  Descriptor location.  Forward link to other descriptors.  Blank, or one of the following: Waiting
       for  input,  indefinite	wait  Waiting  for input, timed wait Has timed out Addresses of ``Queue Elements'' for waiting packets.  Number of
       packets queued for input/maximum for this queue.  Timeout duration in clock ticks (if the -v [Verbose] option is not given, the	times  may
       be  expressed  as minutes [with a trailing ``m''], hours [with a trailing ``h''], or simply ``long'', to keep the columns lined up.)  Shows
       which mode bits are set for the minor device; each bit is encoded as a single character: ENHOLDSIG  ENBATCH  ENTSTAMP  ENPROMISC  ENNONEXCL
       ENCOPYALL  ENBPFHDR An unknown mode bit is set.	Signal number to be delivered when a packet arrives.  Process to be signaled when a packet
       arrives.  Process id which enabled the signal.

   Filters
       Minor device number of filter.  Count of packets accepted by this filter.  Count of ``recent'' drops for this filter.  Priority of  filter.
       (Not  applicable  to BPF-style filters.)  Length of filter (in shortwords).  See packetfilter(7) for interpretation of packet filters.  See
       bpf(7) for interpretation of BPF-style filters.

   QueueElts
       Location of queue element.  Forward and backward links.	Packet size.  Reference count for queue element.  Per-packet flag bits	set;  each
       bit is encoded as a single character: ENSF_PROMISC ENSF_BROADCAST ENSF_MULTICAST ENSF_TRAILER An unknown flag bit is set.  Count of packets
       dropped between the time previous packet was queued and the time this packet was queued.  Approximate time this packet was received.

FILES

       Default source of tables

SEE ALSO

       Commands:  netstat(1), pfconfig(8)

       Files:  bpf(7), packetfilter(7)

																	 pfstat(1)

Check Out this Related Man Page

PCAP_STATS(3PCAP)														 PCAP_STATS(3PCAP)

NAME

       pcap_stats - get capture statistics

SYNOPSIS

       #include <pcap/pcap.h>

       int pcap_stats(pcap_t *p, struct pcap_stat *ps);

DESCRIPTION

       pcap_stats() fills in the struct pcap_stat pointed to by its second argument.  The values represent packet statistics from the start of the
       run to the time of the call.

       pcap_stats() is supported only on live captures, not on ``savefiles''; no statistics are stored in  ``savefiles'',  so  no  statistics  are
       available when reading from a ``savefile''.

       A struct pcap_stat has the following members:

	      ps_recv
		     number of packets received;

	      ps_drop
		     number  of  packets  dropped  because  there  was no room in the operating system's buffer when they arrived, because packets
		     weren't being read fast enough;

	      ps_ifdrop
		     number of packets dropped by the network interface or its driver.

       The statistics do not behave the same way on all platforms.  ps_recv might count packets whether they passed any filter set with  pcap_set-
       filter(3PCAP)  or  not,	or  it	might count only packets that pass the filter.	It also might, or might not, count packets dropped because
       there was no room in the operating system's buffer when they arrived.  ps_drop is not available on all platforms; it is zero  on  platforms
       where  it's  not available.  If packet filtering is done in libpcap, rather than in the operating system, it would count packets that don't
       pass the filter.  Both ps_recv and ps_drop might, or might not, count packets not yet read from the operating system and thus not yet  seen
       by  the	application.   ps_ifdrop  might,  or  might not, be implemented; if it's zero, that might mean that no packets were dropped by the
       interface, or it might mean that the statistic is unavailable, so it should not be treated as an indication that the interface did not drop
       any packets.

RETURN VALUE

       pcap_stats()  returns  0  on  success  and  returns  -1 if there is an error or if p doesn't support packet statistics.	If -1 is returned,
       pcap_geterr() or pcap_perror() may be called with p as an argument to fetch or display the error text.

SEE ALSO

       pcap(3PCAP), pcap_geterr(3PCAP)

								 7 September 2009						 PCAP_STATS(3PCAP)

Linux and UNIX Man Pages

pfstat(1) [osf1 man page]

Check Out this Related Man Page