Read PPP Link Counters Safely with pppstats

pppstats gives you a live readout of a PPP link's byte and packet counters, one-shot or repeating, without touching the connection itself. Ten minutes if you already know the link name. This follows the pppstats(8) manual shipped with the Ubuntu ppp package here, version 2.4.9-1+1.1ubuntu4.

The utility is old enough that its output format and kernel interface count as version-specific, not something to assume matches a different PPP implementation. None of the examples bring a link up, change configuration or restart a service; they only read.

1. Confirm the installed command

$ command -v pppstats
/usr/sbin/pppstats
$ dpkg-query -W -f='${Package} ${Version}\n' ppp
ppp 2.4.9-1+1.1ubuntu4
$ man pppstats

2. Identify the PPP interface

pppstats defaults to ppp0 when you give it no interface. Convenient on a single-link box, and also the single most common source of confusion: plenty of machines have no ppp0 at all, or their active link answers to a different name. Check the interfaces before you trust an error message.

$ ip -brief link
$ ip -brief address
$ ls /sys/class/net

Pick an interface whose name actually exists, then stash it in a shell variable so later commands stay easy to read back:

$ PPP_IF='ppp0'
$ test -e "/sys/class/net/$PPP_IF" && echo "interface exists: $PPP_IF"
interface exists: ppp0

Swap in the exact name from your own host. If the test fails, do not guess: a missing interface usually means the PPP session is down or answers to a different name, and pppstats has no power to create one.

3. Take one safe snapshot

Run a single report first. Leave off -w and the manual's default repeat count is already one; adding -c 1 just makes that intention visible in a script or an incident note.

$ pppstats -c 1 "$PPP_IF"
  IN  PACK  VJCOMP  VJUNC  VJERR       OUT  PACK  VJCOMP  VJUNC  NON-VJ
    ...interface counters...

Exact spacing and numbers depend on traffic and the installed kernel PPP support. The input section covers received traffic, the output section transmitted; IN and OUT are byte counts, and each PACK column a packet count. A quiet link can legitimately show all zeroes, whereas a nonexistent interface throws an error instead:

$ pppstats -c 1 ppp0
pppstats: nonexistent interface 'ppp0' specified

That message just means the named interface was not available to the program at that moment. Re-run the interface checks and confirm the PPP session before reaching for elevated privileges. If a real interface exists but access is denied, check local device and process permissions first; use sudo only when your host's access policy actually requires it. None of this read-only command needs a configuration edit.

4. Sample a live link at a controlled interval

Want a small time series? Use -w, where the value is seconds between reports. Present without -c, the manual specifies an infinite repeat count, so pick a finite one to keep a diagnostic capture bounded.

$ pppstats -w 5 -c 6 "$PPP_IF"

That asks for six reports, five seconds apart. Without -a, the first report is a starting view and every one after shows activity since the last report; in quiet periods those later values can sit at zero without meaning the link is broken.

For a cumulative view from link start instead, add -a:

$ pppstats -a -w 5 -c 6 "$PPP_IF"

The delta form answers "what moved this interval?" The absolute form answers "what has this link moved since it started?" They are different questions; do not compare their columns as if measuring the same thing.

5. Change the display without changing the link

These switches add extra views. Add them one at a time, or a crowded report becomes its own source of confusion:

• -d reports data rate in kB/s instead of bytes.
• -v adds Van Jacobson TCP header-compression statistics, including receive-side drops and transmit-side cache searches.
• -r adds compression ratios and uncompressed byte totals. Ratios describe uncompressed size divided by compressed size.
• -z replaces the standard report with packet-compression counters. If compression is not in use, the manual says these fields display zeroes.

Here is a short rate sample with compression details thrown in:

$ pppstats -d -r -v -w 5 -c 3 "$PPP_IF"

With -r, some standard columns such as VJUNC, VJERR or NON-VJ disappear depending on the selected report, so read the heading actually printed above the numbers rather than trusting a fixed column position. With -z, look for compressed and incompressible byte and packet counts on both sides, plus a recent compression ratio.

6. Diagnose a result before escalating

If one snapshot fails, write down the exact interface name and repeat the harmless checks:

$ printf 'requested interface: %s\n' "$PPP_IF"
$ test -e "/sys/class/net/$PPP_IF" && echo present || echo absent
$ pppstats -c 1 "$PPP_IF"
$ printf 'exit status: %s\n' "$?"

A non-zero status or a "nonexistent interface" message points at interface state or naming, not at a missing -a, -d or -z. If the interface vanishes between the check and the report, the PPP session may have renegotiated or dropped. Check the service's existing logs and status commands, but resist restarting it as a blind test: that interrupts the link and sits outside this guide's read-only remit.

For a repeating command, use a finite -c count while collecting evidence. Left it open on purpose? Press Ctrl-C to stop the display. That ends the reporting process, not PPP itself.