
Introduction:

The nstat series of network monitor and analysis tools are useful
for determining a segment's overall load and utilization by service.
This can be used for capacity planning, determining usage policies,
and for spotting clandestine services. (Can you say FSP?)

This package includes three programs:
	nstat.c - data collection program
	nsum    - perl program to print summary histogram
	nload   - awk program to collate data for plotting by xvgr

The nstat data collection program runs on SunOS 4.1.X, using NIT.

You may ask "why not use NNstat?"  Nstat counts packets and bytes
going to *and from* *all* IP ports. Unfortunately, NNstat does not
easily lend itself to this type of collection, as it is simple to
collect data for packets to *all* ports, or *to and from* specified
ports, but not both.

Using the programs:

1. nstat - network utilization statistics collector

	nstat [-i interface][-t time interval (sec)]

The interface defaults to "le0", and the time interval to 3600 seconds
(1 hour). Nstat collects data during the interval, then prints out the 
raw data in a concise ascii format (to stdout), and resets all counters.
The following is some sample output:

#Start Tue May 25 09:21:37 1993
#Stop  Tue May 25 10:21:38 1993
#881974 packets, 146774562 bytes, 19188 802.3, 4 runt, 2762 missed.
e 600   # 300   b 24758
e 800   # 692101        b 125706982
...
i 1     # 1027  b 79884
i 6     # 658235        b 121349056
i 9     # 135   b 166230
i 17    # 32227 b 4075291
...
t 20    # 106475        b 41135245
t 21    # 4734  b 355764
t 23    # 108485        b 9856094
t 25    # 70396 b 18252107
...
u 53    # 17953 b 1877980
u 67    # 4     b 1368
u 68    # 4     b 1368

In this output format, The "Start" and "Stop" lines give the time
period covered. The third "comment" line gives the total number of
packets, bytes, 802.3 packets, runt packets, and dropped packets
during the period.  The subsequent "e", "i", "t", and "u" lines
give details on ethernet types, IP protocols, TCP ports and UDP ports,
respectively.  On each line, the second field specifies the type,
protocol, or port. The number following the "#" is the number of packets,
and the number following the "b" is the number of bytes.
Note that the ethernet type is given in hex, and all other numbers are
in decimal.  In addition, note that every IP packet is counted twice:
once for the source port, and once for the destination port. This is
done so that the numbers for each service (port) include both directions
of data flow.  The trick is to remember to divide by two if summing
all tcp and udp values.


2. nsum - make histogram summary of nstat logs

	nsum [- M | A | D | E | N ] [- w | W ] [ filename ... ]
       		M = morning (8am-11am)
       		A = afternoon (noon - 5pm)
       		D = day  (morning | afternoon)
       		E = evening (6pm - 11pm)
       		N = night (midnignt - 7am)

       		w = workday
       		W = weekend

nsum is a perl program that accepts nstat logs (from files or stdin),
and sumarizes the top ten ethernet, IP, TCP, and UDP usages.  The
optional time or date switches allow you to restrict analysis to the
specified periods. The output is a simple ascii histogram in which each
'#' represents 1 percent.  Each line also gives the utilization
numerically, the first number giving the percent of bytes seen in the
category, the second number giving the percent of total bandwidth.
Note that the total bandwidth of the link needs to be modified for your
situation.  Here is a snippet from an example output:
...
ETH oldIPX    ( 4%/ 3%):####
...
IP  UDP      ( 6%/ 5%):######
...
TCP ftp-data (30%/24%):##############################
...
UDP route    (28%/ 1%):############################
...


3. make a simple network load graph

Since the nstat output is relatively easy to parse with AWK, you
can make a simple overall load graph with:

cat nstat.log.*.Z|awk '/packet/ { print ($3/(1728*1024) ) }'- \
	|xvgr -source stdin

Note that the "1728*1024" is our bandwidth in bytes per hour,
divided by 100 (to get %). (384Kbits/sec * 8 * 1024 bytes/K /100)

4. nload - graph network utilization

Nload is a more complex example of using an AWK program and xvgr 
parameter file to plot more detailed utilization graph. This program
picks out details on our top services (FTP, NNTP, MUD, SMTP, and TELNET),
and graphs their load, along with an "other" category in a convenient
stacked bar format. Here again, the units are % of total bandwidth, 
where our total bandwidth is specified with the "bph=1728*1024"
declaration in nload. Here is an example invocation:

cat nstat.log.*.Z|awk -f nload -| xvgr -nxy -p nload.prm -source stdin
