Monitoring Interfaces

Each interface has associated counters, which enable traffic volume and error monitoring.


To limit the amount of administrative traffic, VPP only updates these counters every 10 seconds.

There are several commands used to monitor interfaces: show interface, show interface counters, interface clear counters, and show packet-counters. Additionally, the counters may be retrieved using RESTCONF.

show interface

The show interface command prints important traffic volume and error counters specific to each interface. For example:

tnsr# show interface

Interface: TenGigabitEthernet6/0/0
    Admin status: up
    Link up, link-speed 10 Gbps, full duplex
    Link MTU: 1500 bytes
    MAC address: 90:ec:77:47:5e:59
    VRF: default
    IPv4 addresses:
    IPv6 addresses:
        queue-id 0 : cpu-id any : rx-mode polling
      received: 11294870 bytes, 188247 packets, 0 errors
      transmitted: 11292306 bytes, 188292 packets, 0 errors
      protocols: 187923 IPv4, 1 IPv6
      323 drops, 0 punts, 0 rx miss, 0 rx no buffer

The show interface command also supports filtering of its output. When the list is filtered, its name, description, and administrative status are printed along with the chosen output.


Prints the access control lists configured on an interface


Prints a summarized list of interfaces, their status, and IP addresses.


Prints the interface traffic counters for an interface

ip [(nat|vrrp-virtual-router)]

Prints the IPv4 addresses present on the interface and the IPv4 route table used by the interface.


Prints the NAT role for an interface (e.g. inside or outside)


Prints the IPv4 VRRP status for an interface.

ipv6 [(router-advertisements|vrrp-virtual-router)]

Prints the IPv6 addresses present on the interface and the IPv6 route table used by the interface.


Prints the current IPv6 router advertisement configuration and status, including associated timers and counters.


Prints the IPv6 VRRP status for an interface.


Prints the link status (e.g. up or down), media type and duplex, and MTU


Prints the hardware MAC address, if present


Prints VLAN subinterface attributes for an interface.

vlan tag-rewrite

Shows VLAN tag rewriting attributes for an interface.

These keywords may be used with the entire list of interfaces, for example:

tnsr# show interface ip

The filtering may also be applied to a single interface:

tnsr# show interface TenGigabitEthernet6/0/0 link

show interface brief

The show interface brief command prints a summarized list of interfaces, their status, and IP addresses:

tnsr# show interface brief
Interface    Admin Status    Link Status     Address
DMZ          down            down            no addresses assigned
GUEST        up              down  
LAN          up              up    
LAN          up              up              2001:db8:f0::1/64
LAN          up              up              fe80::290:bff:fe7a:8a65/64
WAN          up              up    
WAN          up              up              2001:db8:0:2::2/64
WAN          up              up              fe80::290:bff:fe7a:8a67/64

show interface counters

The show interface [<if-name>] counters [verbose] command displays detailed information on all available interface counters.

Example output:

tnsr(config)# show interface TenGigabitEthernet6/0/0 counters
Interface: TenGigabitEthernet6/0/0
      received: 9253580 bytes, 61588 packets, 0 errors
      transmitted: 628148 bytes, 5755 packets, 8 errors
      protocols: 12810 IPv4, 5101 IPv6
      50972 drops, 0 punts, 0 rx miss, 0 rx no buffer

Additional detailed packet counters for transmit and receive of unicast, multicast, and broadcast traffic may be enabled or disabled on a per-interface basis (Interface Configuration Options). Add the verbose keyword to display these statistics:

tnsr(config)# show interface TenGigabitEthernet6/0/0 counters verbose
Interface: TenGigabitEthernet6/0/0
    detailed counters:
      received: 9258555 bytes, 61641 packets, 0 errors
      received unicast: 2464 bytes, 18 packets
      received multicast: 2464 bytes, 18 packets
      received broadcast: 622 bytes, 8 packets
      transmitted: 628676 bytes, 5761 packets, 8 errors
      transmitted unicast: 2480 bytes, 18 packets
      transmitted multicast: 2480 bytes, 18 packets
      transmitted broadcast: 0 bytes, 0 packets
      protocols: 12820 IPv4, 5105 IPv6
      51016 drops, 0 punts, 0 rx miss, 0 rx no buffer

Counter values take a minimum of 10 seconds to be populated with valid data.

clear interface counters

The interface clear counters <name> command clears all counters on a given interface. This command is available in config mode. If no specific interface is given, all interfaces will have their counters cleared:

tnsr# configure
tnsr(config)# interface clear counters
Counters cleared

show packet-counters

The show packet-counters command prints packet statistics and error counters taken from the dataplane. These counters show counts of packets that have passed through various aspects of processing, such as encryption, along with various types of packet send/receive errors. The set of counters displayed will vary depending on the set of enabled features, such as NAT, IPsec, and so on.

Example output:

tnsr# show packet-counters
   Count                    Node                  Reason
       624            dpdk-crypto-input           Crypto ops dequeued
       624          dpdk-esp-decrypt-post         ESP post pkts
       624            dpdk-esp-decrypt            ESP pkts received
       622               esp-encrypt              ESP pkts received
       624             ipsec-if-input             good packets received
       304                ip4-input               Multicast RPF check failed
         9                 ip4-arp                ARP requests sent
        22               lldp-input               lldp packets received on disabled interfaces
         8             ethernet-input             no error
         2             ethernet-input             unknown ethernet type
      5821             ethernet-input             unknown vlan
        16                arp-input               ARP request IP4 source address learned
        28      GigabitEthernet0/14/0-output      interface is down
         8       GigabitEthernet3/0/0-output      interface is down

Interface status via API

If the RESTCONF API is enabled, the interface counter data may also be polled that way. For example:


$ curl --cert ~/tnsr/tnsr-myuser.crt \
  --key ~/tnsr/tnsr-myuser.key \
  --cacert ~/tnsr/tnsr-selfca.crt \
  -X GET \


    "netgate-interface:counters": {
      "collect-time": 1563807148,
      "reset-time": 0,
      "detailed-counters": true,
      "rx-bytes": 120317,
      "rx-packets": 736,
      "rx-unicast-bytes": 19775,
      "rx-unicast-packets": 102,
      "rx-multicast-bytes": 97965,
      "rx-multicast-packets": 597,
      "rx-broadcast-bytes": 2577,
      "rx-broadcast-packets": 37,
      "rx-ip4": 175,
      "rx-ip6": 57,
      "tx-bytes": 15530,
      "tx-packets": 101,
      "tx-unicast-bytes": 15178,
      "tx-unicast-packets": 95,
      "tx-multicast-bytes": 226,
      "tx-multicast-packets": 3,
      "tx-broadcast-bytes": 126,
      "tx-broadcast-packets": 3,
      "drop": 601,
      "punt": 0,
      "rx-no-buffer": 0,
      "rx-miss": 0,
      "rx-error": 0,
      "tx-error": 21