Download Source

Sample Output

Tested Platforms




tcpstat reports certain network interface statistics much like vmstat does for system statistics. tcpstat gets its information by either monitoring a specific interface, or by reading previously saved tcpdump data from a file.

Some of the statistics tcpstat calculates:

  • bandwidth
  • number of packets
  • packets per second
  • average packet size
  • standard deviation of packet size
  • interface load
  • more...

tcpstat is written with performance and efficiency in mind and is capable of handling large amounts of packets per second. Its compact command line interface is geared for the network researcher, system administrator and desktop shell user. tcpstat has been a valuable tool in university research papers and commercial networks alike.

Download Source

tcpstat is distributed in source form.

(see ChangeLog for Changes, MD5.TXT for MD5 signatures.)
tcpstat requires the libpcap library from

Sample Output

This is the default display and looks like:
   bash-2.03$ tcpstat -i eth0
   Time:940948785  n=107   avg=251.81      stddev=422.45   bps=43110.40
   Time:940948790  n=99    avg=400.21      stddev=539.39   bps=63393.60
   Time:940948795  n=43    avg=257.16      stddev=352.83   bps=17692.80

These default statistcs are (from left to right):

  • timestamp
  • the number of packets passed through the interface
  • the average size of each packet
  • the standard deviation of the packet size
  • the bandwidth in bits per second.
tcpstat is fully configurable, and is not limited to just these statistics. The manpage details more than 15 different types of statistics. You can easily pipe the output of tcpstat into plotting programs to produce graphical views of the data produced by tcpstat.
  • mrtg, rrdtool: One tcpstat user has contributed a small rrdtool example to use tcpstat with rrdtool and MRTG.
  • gnuplot: The data produced by tcpstat can also be graphed using gnuplot. To see how I made the following graphs, see this short tcpstat/gnuplot HOWTO.

Image of protocol breakdown
Breakdown of protocols over ethernet, produced by tcpstat and gnuplot(1)

Image of bandwidth usage
Bandwidth + Interface Load over DSL Line, produced by tcpstat and gnuplot(1)

Tested Platforms

  • BSD Based
    • FreeBSD 3.x, 4.x, 5.0
    • NetBSD 1.5
    • OpenBSD 2.7
    • BSD/OS 3.0, 4.0
    • MacOS X 10.1, 10.2, 10.3
  • Compaq/Digital
    • Tru64 Unix 4.0 (thanks to Compaq testdrive program)
    • Tru64 Unix 5.1 (thanks to Compaq testdrive program)
  • HP
    • HPUX 11.0
  • IBM
    • AIX 4.3
  • Linux
    • Debian 2.2
    • Mandrake 7.2, 8.0
    • RedHat 6.0, 6.2, 7.0, 7.2, 8.0
    • Slackware 7.0, 8.0, 9.0, 10.0
    • SuSE 6.4, 7.0, 8.0
    • TurboLinux IA64 000828 (thanks to Compaq testdrive program)
  • Sun
    • Solaris 2.5, 2.6, 7, 8, 9
  • <Your OS Here?>

tcpstat should compile for most unices. If your operating system is not listed here, try it out. If you do, send me a mail and tell me how it went.


tcpstat is openly distributed as source code under a "BSD" style license (please read the LICENSE file included with the source for details.)

Back to projects page
Back to my home page
Back to the pslc home page
Paul Herman
Last Updated: June 16, 2009