How to Read a Layer4 Dstat
A Layer4 Dstat reports a flood in two numbers at once: bandwidth and packet rate. Read together, they show what kind of traffic is arriving and whether the limit sits at the target or in the network in front of it. This guide explains each series, how to work out the average packet size, and how to interpret peaks and drops.
Two series, two limits
Bandwidth, measured in Gbps, is the amount of data arriving each second. Packet rate, measured in pps, is the number of packets arriving each second. They limit different things: bandwidth fills the link, while packet rate loads routers, firewalls and network cards, each of which can process only a finite number of packets. A target can be in trouble while one series looks calm and the other does not.
Work out the average packet size
Dividing bandwidth by packet rate gives the average packet size. At 10 Gbps and 1,000,000 pps the average packet is 1,250 bytes (10,000,000,000 bits ÷ 8 ÷ 1,000,000 packets); at the same 10 Gbps and 10,000,000 pps it is 125 bytes.
Large packets point to a bandwidth-heavy flood such as UDP or an amplification attack; small packets point to a packet-heavy flood such as a SYN flood. Packet size is a clue, not proof, because attackers can mix sizes.
Peaks, plateaus and drops
The headline numbers are window peaks: the peak bandwidth and the peak packet rate in the rolling window. A peak shows how hard the target was hit; a plateau shows how long it kept absorbing the load.
A drop can mean the attack stopped, upstream mitigation began filtering, or the link saturated and traffic stopped arriving. Check whether the target still responds before deciding which.
What Layer4 does not show
A Layer4 Dstat sees volume, not content. It cannot tell a legitimate packet from a hostile one, and it does not show whether an application is answering requests. For that, compare it with a Layer7 Dstat, which counts HTTP requests and shows how many were passed, bypassed or blocked.
Reading Layer4 Dstats — FAQ
Why does a Layer4 Dstat show both Gbps and pps?
Because they measure different limits. Bandwidth shows how full the link is, and packet rate shows how hard routers and firewalls are working. A small-packet flood can exhaust the second while barely moving the first.
How do I work out the average packet size?
Convert bandwidth to bits per second, divide by 8 to get bytes per second, then divide by the packet rate. For example, 10 Gbps at 1,000,000 pps is an average of 1,250 bytes per packet.
Does a drop in the graph mean the attack ended?
Not always. It can also mean upstream mitigation started filtering, or that the link saturated and stopped receiving traffic. Check whether the target still responds to tell the cases apart.