Network Performance Analysis

Network Performance Analysis

Network performance problems manifest as slow transfers, high latency, or connection drops. The tools available let you measure raw bandwidth between hosts, see which processes are using the most bandwidth, and inspect interface error counters that indicate physical layer issues. Starting with the right tool for the symptom — bandwidth measurement vs per-process analysis vs error counters — saves significant diagnostic time.

iperf3: measuring bandwidth

iperf3 measures the actual TCP/UDP throughput between two hosts. Use it when you suspect bandwidth is lower than expected — it eliminates application-level variables and measures raw network capacity.

sudo apt install -y iperf3

# On the receiving end (server mode):
iperf3 -s

# On the sending end (client mode):
iperf3 -c SERVER_IP

iperf3 output

Connecting to host 192.168.1.20, port 5201
[ ID] Interval           Transfer     Bitrate         Retr
[  5]   0.00-1.00   sec  112 MBytes   941 Mbits/sec    0
[  5]   1.00-2.00   sec  113 MBytes   948 Mbits/sec    0
[  5]   9.00-10.00  sec  113 MBytes   948 Mbits/sec    0
- - - - - - - - - - - - - - - - - - - - - - - - -
[ ID] Interval           Transfer     Bitrate         Retr
[  5]   0.00-10.00  sec  1.10 GBytes   944 Mbits/sec    0   sender
# Retr = TCP retransmissions — non-zero indicates packet loss or congestion

# Test in reverse (server sends to client)
iperf3 -c SERVER_IP -R

# Test UDP performance (useful for VoIP/video)
iperf3 -c SERVER_IP -u -b 100M    # Send at 100 Mbps UDP

# Parallel streams (more realistic for large file transfers)
iperf3 -c SERVER_IP -P 4          # 4 parallel streams

Per-process network usage

# nethogs: shows bandwidth per process in real time
sudo apt install -y nethogs
sudo nethogs ens3    # Monitor specific interface

nethogs output

NetHogs version 0.8.5
  PID USER   PROGRAM          DEV    SENT   RECEIVED
12345 mysql  /usr/sbin/mysqld ens3   0.234  1.234 MB/sec
 5678 www    /usr/sbin/nginx  ens3   2.100  0.023 MB/sec

# iftop: shows bandwidth by connection pair
sudo apt install -y iftop
sudo iftop -n -i ens3    # -n: no DNS lookups, -i: interface

Interface error counters

# Show error counters for all interfaces
ip -s link show ens3

ip -s link output with error counters

RX: bytes  packets  errors  dropped missed  mcast
    123456  1234     0       0       0       0
TX: bytes  packets  errors  dropped carrier collisions
    654321  5678     0       0       0       0
#                    ↑        ↑
#          errors/dropped > 0 = physical layer problem
#          (bad cable, duplex mismatch, congested switch)

# Monitor counters in real time
watch -n 1 'ip -s link show ens3 | grep -A3 "RX:"'

# ethtool: NIC-level diagnostics
sudo apt install -y ethtool
ethtool ens3     # Speed, duplex, link status
ethtool -S ens3  # Hardware statistics (NIC-specific)

Socket statistics with ss

# Count connections by state (useful for detecting SYN flood or connection exhaustion)
ss -s

ss -s summary output

Total: 245
TCP:   180 (estab 45, closed 120, orphaned 0, timewait 118)

Transport Total     IP        IPv6
RAW       0         0         0
UDP       5         3         2
TCP       60        45        15
INET      65        48        17

# High timewait count: normal for busy web servers — connections are closing cleanly
# High SYN_RECV count: possible SYN flood attack
ss -ant | awk '{print $1}' | sort | uniq -c | sort -rn

Identifying network bottlenecks

Conclusion

Use iperf3 to measure raw bandwidth between two hosts when transfers are slower than the link capacity should allow. Use nethogs to identify which process is consuming the most bandwidth when the interface utilization is high. Check ip -s link error counters when you see random drops or retransmissions — non-zero errors/dropped values indicate a physical layer problem (bad cable, switch port, duplex mismatch). Combine these tools systematically: measure bandwidth, then per-process, then errors, then socket state.