Manpage of stakrate
Section: User Commands (1)
Return to Main Contents
stak - Statistical Traffic Analysis Kit
stakrate [-i <interface>] [-p <prefix>] [-s <snarflen>] [-r <n> | -g | -k] [-q <n>] [-lcvjx] [-X <expression> [-0 <c>]] [-b] [[-f] [filtering expression]]
is a part of the Statistical Traffic Analysis Kit (STAK), which is a set of
utilities designed to help an administrator to figure out what is happening in
his network at the moment.
estimates current and average traffic rate (in bits and packets per
second), as recorded on the given interface. The processed packets are subject to
packet filtering, thus allowing to measure the HTTP traffic exchange rate,
the TCP SYN packets rate, the number of packets per second containing
the string 'HELO', et caetera.
accepts parameters in a standard, short
There are several options concerning the
common for the all
utilities - these options have been described in the
The remaining options, described in the
TRAFFIC ESTIMATOR SPECIFIC OPTIONS
are stakrate-specific and do not apply to other
After a successful startup,
generates reports on recorded traffic rate:
# stakrate -i eth5
=> Currently 4.15 MBps/11.28 kpps, Average: 4.15 MBps/11.28 kpps
=> Currently 4.09 MBps/11.60 kpps, Average: 4.11 MBps/11.41 kpps
=> Currently 3.98 MBps/11.49 kpps, Average: 4.06 MBps/11.42 kpps
Such an output means, that the current traffic rate on the eth5
interface (ie. the number of bytes received and sent on eth5) ranges
from 3.98 to 4.15 megabytes per second, giving an average amount
of 4.06 MBps. The first counter indicates the traffic rate recorded since the last
output, while the second one shows the average rate recorded since the
The output could be presented in bit units if the
user specifies the
# stakrate -bi eth5
=> Currently 33.60 Mbps/11.76 kpps, Average: 33.60 Mbps/11.76 kpps
=> Currently 32.57 Mbps/11.41 kpps, Average: 33.00 Mbps/11.56 kpps
as well as in a more accurate form, without the SI prefixes, if the
option was specified:
# stakrate -vi eth5
=> Currently 4769195.00 Bps/12340.00 pps, Average: 4769195.00 Bps/12340.00 pps
=> Currently 4880502.49 Bps/12711.44 pps, Average: 4812985.07 Bps/12495.02 pps
Before actual counting is made, the packets might be filtered on a BPF-filter basis. For
example, to measure received HTTP traffic, one could use:
# stakrate -f 'dst port 80' -i eth5 -r 1
To measure traffic originating from the 192.168.0.0/16 subnet:
# stakrate -i eth5 'src net 192.168.0.0/16'
As it can be noticed, the
option indicator can be suppressed in case of
For more information on BPF filters, consult the
- -0 c
Replace every NUL character (ASCII 0) with c before doing regular expression
based matching. Ignored if the
option was not specified. The default is '@'.
- -f f
BPF filter expression to use. Using this option causes
to ignore any packets not matching the specified BPF filter expression. For
a detailed description of BPF filter expressions syntax, consult the
Signal-based report generation policy. The reports are dumped
whenever stak receives a SIGUSR1 signal.
- -h -?
dumps a short help on available command-line options and quits, regardless
of other options.
- -i I
Bind to interface I. The default is 'eth0', which of course will cause a failure on
systems other than Linux. Make sure you specify the datalink prefix (see -p)
when you order stak to bind to an interface of an uncommon type.
Interactive report generation. The reports are dumped whenever
data is available on the standard input, which usually means you'll have
to press RETURN in order to generate a report.
Make stdout line-buffered. This option is useful when reports are redirected
(eg. using shell redirection) to a file.
- -p N
Datalink layer header prefix length. Every (or at least almost every) known datalink
layer protocol prefixes a packet with its own header - which has to be stripped
before the actual data essential for stak (the IP protocol header) can be read.
is able to determine automatically how many bytes to skip only for the most common
datalink layer protocols (Ethernet, FDDI, TokenRing, loopback, PPP) - in other cases
the prefix length
must be specified using this option. It is EXTREMELY IMPORTANT to set the right value
might print completely irrevelant reports and output invalid IP addresses. The default
is autosense, or if that fails - 14 bytes, which is the length of an
- -q N
to quit after outputting N reports.
- -r N
Time-based report generation policy. The reports will be dumped on
stdout every N seconds. This is the default (with N = 0.1).
- -s N
Capture at least N bytes. For performance reasons,
does not acquire the whole packet from network, it just reads and processes first N
bytes. The default is 64 bytes, which might be not enough if you are using complicated BPF
expressions or filtering the packets using a regular expression. In such cases, it is
good to set the capture length to MTU on the interface. The value is automatically increased
to at least 1500 (which is the default MTU for an Ethernet interface) if one of -x, -E or -T
options is used. This option does NOT affect statistical data (amount of bytes, per-second byte rate)
collected by stak - the accounted packet size is always the 'real' one.
Print exact values. Normally,
uses SI prefixes (like k - kilo, M - mega, G - giga, T - tera) to make
the printed numeric values more attractive for a human being. The -v option
disables this feature, causing
to print exact values.
Clear the screen before printing each report. This assumes your terminal
is capable of understanding certain control sequences.
- -X r
Regular expression-based filtering. This option will cause
to ignore packets that DO NOT match specified regular expression. Before
any tests, NUL characters occuring in a packet are replaced with
an other character, as specified in the -0 option (the default is '@').
manual for a detailed description of POSIX regular expressions.
In addition to standard regex syntax, you may use the
\r (CR), \n (LF), \t (TAB), \\ (\)
and \xNN (hex NN) special sequences.
TRAFFIC ESTIMATOR SPECIFIC OPTIONS
Present output counters in bits per second in place of bytes per second.
Mateusz Golicz <email@example.com>
Feel free to send comments, suggestions, bug reports, etc. The
author is not a native english speaker, and is aware of the fact that his english is far from
perfect. Because of that, reports on grammar or vocabulary mistakes in this manual are also welcome.
The asynchronous DNS resolver part was taken from
- a very handy traceroute replacement by Matt Kimball.
Copyright 2003 - 2004 Mateusz Golicz. All rights reserved.
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License, Version 2,
as published by the Free Software Foundation. A copy of this license is
distributed with this software in the file "COPYING".
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. Read the
file "COPYING" for more details.
- GENERIC OPTIONS
- TRAFFIC ESTIMATOR SPECIFIC OPTIONS
- SEE ALSO
This document was created by
using the manual pages.
Time: 14:58:41 GMT, March 21, 2004