Layer4 Dstat — Live Network-Layer Traffic

A Layer4 Dstat measures traffic at the transport layer (OSI Layer 4): raw TCP/UDP volume expressed in bits per second (bps / Gbps) and packets per second (pps). It is the standard way to visualize volumetric floods such as UDP, SYN and amplification attacks, whose goal is to saturate the target's bandwidth or exhaust its network stack. Most people simply call this a Layer 4 DDoS graph.

Unlike an application metric, a Layer4 Dstat does not care what the requests contain — it counts the sheer volume of packets and bytes arriving on the wire. That makes it the right lens for capacity attacks, where impact is determined by raw throughput rather than request logic.

A Layer4 Dstat is measured in bandwidth and packets and reflects link / device saturation; a Layer7 Dstat is measured in requests per second (RPS) and reflects how application protections (WAF, JS challenges, CAPTCHA, rate limits) hold up. The two answer different questions and are usually defended in different ways — Layer 4 upstream by scrubbing and capacity, Layer 7 at the edge by filtering.

Watch two series: throughput (bps / Gbps) shows how much bandwidth the flood consumes, and packet rate (pps) shows how hard the network stack is being pushed — small-packet floods can exhaust pps long before they fill the pipe. A sustained high plateau means the target is absorbing the load; a sharp drop usually means a link saturated or upstream mitigation kicked in.