When we are talking about a server, its network is the most important resource. Especially in the cloud network, when it is the only communication channel to access the server and connect with other servers in the network. The network comes under an Input/Output device category. Networks are generally slow in performance and are an unreliable communication channel. You may lose some data while in transit, data may be exposed to external entities, or a malicious guy can update original data before it reaches you.
The Ubuntu server, as well as Linux in general, provides tons of utilities to ease network monitoring and administration. This recipe covers some inbuilt tools to monitor network traffic and its performance. We will also look at a few additional tools that are worth a space on your system.
Getting ready
Some commands may need sudo access.
You may need to install a few tools.
How to do it…
We will start with a commonly used command, that is, ifconfig. We mostly use this command to read the network configuration details such as the IP address. When called without any parameters, ifconfig displays details of all active network interfaces as follows:
These details contain the IP address assigned to each network interface, its hardware address, the maximum packet size (MTU) and basic statistics of received (RX) and transmitted (TX) packets, and the count of errors or dropped packets, and so on.
If you are only interested in quick network statistics, use ifconfig with flag -s, as follows:
If you do not see a specific network interface listed in the active list, then query for all available interfaces with the -a option to ifconfig.
Another commonly used command is ping. It sends ICMP requests to a specified host and waits for the reply. If you query for a host name, ping will get its IP address from DNS. This also gives you confirmation that the DNS is working properly. Ping also gives you the latency of your network interface. Check for the time values in the output of the ping command:
Next, comes netstat. It is mainly used to check network connections and routing tables on the system. The commonly used syntax is as follows:
$ sudo netstat -plutn
The preceding command should list all TCP (-t) / UDP (-u) connections, plus any ports that are actively listening (-l) for connection. The flag, -p, queries the program name responsible for a specified connection. Note that flag -p requires sudo privileges. Also check flag -a to get all listening as well as non-listening sockets, or query the routing table information with flag -r as follows:
$ netstat -r
You can also get protocol level network statistics using the netstat command as follows:
$ netstat -s
One more utility very similar to netstat is ss. It displays detailed TCP socket information. Use ss without any parameters to get a list of all the sockets with a state established.
Another command, lsof, gives you a list of all open files. It includes the files used for network connections or sockets. Use with flag -i to list all network files, as follows:
$ sudo lsof -i
To filter output, use flag -s with protocol and state as filter options:
$ sudo lsof -iTCP -sTCP:LISTEN
Next, we will look at a well-known tool, tcpdump. It collects network traffic and displays it to a standard output or dump in a file system. You can dump the content of the packets for any network interface. When no interface is specified, tcpdump defaults to the first configured interface, which is generally eth0. Use it as follows to get a description of packets exchanged over eth0:
$ sudo tcpdump -i eth0
To log raw packets to a file, use flag -w. These logged packets can later be read with the -r flag. The following command will log 100 packets from the interface eth0 to the file tcpdump.log:
$ sudo tcpdump -i eth0 -w tcpdump.log -c 100
$ tcpdump -r tcpdump.log
Next, to get statistics of network traffic, use the command sar. We have already used sar to get CPU and memory statistics. To simply extract all network statistics, use sar as follows:
$ sar -n ALL 1 5
This will log all network statistics at an interval of 1 second. You can also enable periodic logging in the file /etc/default/sysstat. For network specific usage of sar, check flag -n in the man pages.
There is one more utility named collectl which is similar to sar. In the same way as sar, you will need to separately install this command as well:
$ sudo apt-get install collectl
Once installed, use collectl with the -s flag and value sn to get statistics about the network. Using it without any parameters gives you statistics for the CPU, disk, and network:
How it works…
This recipe covers various network monitoring commands including the commonly used ifconfig and ping, netstat, tcpdump, and collectl.
If you have been working with Linux systems for a while, you should have already used the basic network commands, ifconfig and ping. Ifconfig is commonly used to read network configuration and get details of network interfaces. Apart from its basic use, ifconfig can also be used to configure the network interface. See article 2, Networking, to get more details on network configuration. With netstat, you can get a list of all network sockets and their respective processes using those socket connections. With various parameters, you can easily separate active or listening connections and even separate connections with the protocol being used by the socket. Additionally, netstat provides details of routing table information and network statistics as well. The command ss provides similar details to netstat and adds some more information. You can use ss to get memory usages of socket (-m) and the process using that particular socket (-p). It also provides various filtering options to get the desired output. Check the manual pages of ss with the command, man ss.
There's more…
Following are some more commands that can be useful when monitoring network data. With a limit on page count, it is not possible to cover them all, so I am simply listing the relevant commands:
nethogs: Monitors per process bandwidth utilization
ntop / iftop: Top for network monitoring
iptraf: Monitors network interface activity
vnstat: Network traffic monitoring with logging
ethtool: Queries and configures network interfaces
nicstat / ifstat / nstat: Network interface statistics
tracepath: Traces a network route to destination host
