monitoring network traffic

there are commands to monitor the memory, paging, io... how about network traffic. i mean commands to see whether the network traffic (LAN) is congested? the closest i got is netstat

thanks

tcpdump and netstat is all that comes to mind

What do you want to see?

Some implementations of netstat allow flags with more information:

netstat -s

netstat -p tcp

netstat -p ip

See the man page of netstat, for the specific flag do you
want.

Do you have a lot of connections dropped, data packets retransmited ?

Note: An unproportional data packets retransmited shall mean
that there are a lot of collisions that could signicate a network
congestion.or not?

Regards. Hugo.

i want to see whether the network is the bottleneck for our application to be slow.

i search google and find some network monitoring. but they are all third party software..

therefore, am i right to say that there are no commands in the unix system th check the network performance?

by the way, big brother is quite popular.. for network monitoring

What you can do depends on your network topology and your specific OS. Someday, I hope, people will include a few details with their questions. But I will assume that your network is identical to mine and work from there.

Every unix system that I know of has some way to see statistics kept by the lan driver. With HP-UX, lanadmin can do that (in menu mode). At best, this will only enable measurements on the local ethernet segment. And these days, even that becoming very rare. Your average unix host is connected to an ethernet switch and can only see packets to and from it. Still, this is a start and you should ensure good communications with your system's link partner.

To measure latency across a complex network, traceroute is an option. If your routers and firewalls allow traceroute to work, it can tell you where a delay is...if it is a persistent delay.

To measure performance host to host, I usually just ftp a 1 GB file and time the result. I know it's low tech, but I like that. Most ftp clients perform the timing automatically.

Routers and switches keep on-board statistics. They tend to have a service port that you can access via telnet. They can also report their statistics via snmp but this requires software that you need to purchase. Your network team should be using these or some other technique to monitor their boxes. I am not an expert in this stuff so I cannot really comment further. But if you are your "network team", you need to check the docs for your network boxes to see what is available.

concerning testing the traffic from host to host by FTPing a 1 gig byte. can you tell me what you would do if you notice the traffic is kinda slow?? what would you do to fix it???

First, I make sure that the network is the bottleneck. Once I'm sure that it is, I complain to the network people. They take it from there.

Sometimes I have to work with them. And I do need to be sure that the host is talking correctly to its link partner. If a network card is in half-duplex mode, while the port is in full-duplex mode then network performance will suffer severely and at least half of that problem is mine.

But you need to understand that the network is not my responsibility. I am part of a team that administers some things that connect to it.