What is ifpps?
//////////////

(derived from ftp://ftp.tik.ee.ethz.ch/pub/students/2011-FS/MA-2011-01.pdf)

For measurement purposes, we have implemented a tool called ifpps, which
periodically provides top-like networking and system statistics from the
kernel. ifpps gathers its data directly from procfs files and does not
apply any user space monitoring libraries such as libpcap [120] which is
used in tools like iptraf [121], for instance.

The main idea behind ifpps is to apply principles from section 2.2.1 in
order to be able to have more accurate networking statistics under a high
packet load. For instance, consider the following scenario: two directly
connected Linux machines with Intel Core 2 Quad Q6600 2.40GHz CPUs,
4 GB RAM, and an Intel 82566DC-2 Gigabit Ethernet NIC are used for
performance evaluation. One machine generates 64 Byte network packets by
using the kernel space packet generator pktgen with a maximum possible
packet rate. The other machine displays statistics about incoming network
packets by using i) iptraf and ii) ifpps.

iptraf, that incorporates libpcap, shows an average packet rate of 246,000 pps
while on the other hand ifpps shows an average packet rate of 1,378,000 pps.
Hence, due to copying packets and deferring statistics creation into user space,
a measurement error of approx. 460 per cent occurs. Tools like iptraf, for
instance, display much more information such as TCP per flow statistics
(therefore the use of libpcap), which we have not implemented in ifpps because
overall networking statistics are in our focus. The principle P1 in our case
is applied by avoiding collecting network packets in user space for statistics
creation. Further, principle P2 means that we let the kernel calculate packet
statistics, for instance, within the network device drivers. With both
principles applied, we fetch network driver receive and transmit statistics
from procfs. Hence, the following files are of interest for ifpps:

 * /proc/net/dev: network device receive and transmit statistics
 * /proc/softirqs: per CPU statistics about scheduled NET_RX and NET_TX
                   software interrupts (section 3.1)
 * /proc/interrupts: per CPU network device hardware interrupts
 * /proc/stat: per CPU statistics about time (in USER_HZ) spent in user,
               system, idle, and IO-wait mode
 * /proc/meminfo: total and free memory statistics

Every given time interval (t, default: t = 1s), statistics are parsed from
procfs and displayed in an ncurses-based [122] screen. An example ifpps output
of ifpps eth0 looks like the following:

 Kernel net / sys statistics for eth0
 
 RX:      0.003 MiB/t         20 pkts/t   0 drops/t  0 errors/t
 TX:      0.000 MiB/t          2 pkts/t   0 drops/t  0 errors/t
 
 RX:    226.372 MiB       657800 pkts     0 drops    0 errors
 TX:     12.104 MiB       101317 pkts     0 drops    0 errors
 
 SYS:    2160 cs/t    43.9% mem           1 running       0 iowait
 
 CPU0:  0.0% usr/t     0.0% sys/t    100.0% idl/t   0.0% iow/t
 CPU1:  0.0% usr/t     0.5% sys/t     99.5% idl/t   0.0% iow/t
 CPU2:  0.5% usr/t     0.0% sys/t     99.5% idl/t   0.0% iow/t
 CPU3:  4.9% usr/t     0.5% sys/t     94.6% idl/t   0.0% iow/t
 
 CPU0:     7 irqs/t            7  soirq RX/t        0  soirq TX/t
 CPU1:     8 irqs/t            8  soirq RX/t        0  soirq TX/t
 CPU2:     3 irqs/t            3  soirq RX/t        0  soirq TX/t
 CPU3:     3 irqs/t            4  soirq RX/t        0  soirq TX/t
 
 CPU0:    158842 irqs
 CPU1:    158704 irqs
 CPU2:    159393 irqs
 CPU3:    158710 irqs
 
The first two lines display received and transmitted MiB, packets, dropped
packets, and errors for the network device eth0 within a given time interval t.
The next two lines show their aggregated values since boot time. Moreover, the
line starting with SYS shows context switches per t seconds, current memory
usage, currently running processes and processes waiting for I/O to complete.
Furthermore, ifpps displays per CPU information about CPU percentage spent
executing in user mode, kernel mode, idle mode and I/O wait mode. Next to
this, per CPU hardware and software interrupts are shown. Displayed hardware
interrupts are only hardware interrupts that were caused by the networking
device eth0. Software interrupts are not further distinguished by devices,
thus only per CPU receive and transmit overall statistics are provided.
However, the last lines show aggregated eth0 hardware interrupts since boot
time.

Furthermore, ifpps supports setting the network adapter into promiscuous mode
by applying option --promisc, i.e.

  ifpps --dev eth0 --promisc.
