chore(shell): Add mpstat and doc (#1889)

# Description

See title.

## Related Issue

If this pull request is related to any issue, please mention it here.
Additionally, make sure that the issue is assigned to you before
submitting this pull request.

## Checklist

- [x] I have read the [contributing
documentation](https://retina.sh/docs/Contributing/overview).
- [x] I signed and signed-off the commits (`git commit -S -s ...`). See
[this
documentation](https://docs.github.com/en/authentication/managing-commit-signature-verification/about-commit-signature-verification)
on signing commits.
- [x] I have correctly attributed the author(s) of the code.
- [x] I have tested the changes locally.
- [x] I have followed the project's style guidelines.
- [x] I have updated the documentation, if necessary.
- [x] I have added tests, if applicable.

## Screenshots (if applicable) or Testing Completed

<img width="2539" height="975" alt="Screenshot 2025-09-26 153300"
src="https://github.com/user-attachments/assets/f93c1d8e-a9c7-49eb-9a21-c677a8317596"
/>

<img width="1910" height="556" alt="Screenshot 2025-09-26 152236"
src="https://github.com/user-attachments/assets/cf7a476d-6649-40ac-b816-166364f849fd"
/>


## Additional Notes

Add any additional notes or context about the pull request here.

---

Please refer to the [CONTRIBUTING.md](../CONTRIBUTING.md) file for more
information on how to contribute to this project.

Author: SRodi

docs/06-Troubleshooting/shell.md

@@ -227,6 +227,16 @@ ig -h
 ig run trace_dns:latest
 ```
 
+## [mpstat](https://www.man7.org/linux/man-pages/man1/mpstat.1.html)
+
+Tool for detailed reporting of processor-related statistics. `mpstat` is useful for network troubleshooting because it shows how much CPU time is spent handling SoftIRQs, which are often triggered by network traffic, helping identify interrupt bottlenecks or imbalanced CPU usage. SoftIRQs (Software Interrupt Requests) are a type of deferred interrupt handling mechanism in the Linux kernel used to process time-consuming tasks—like network packet handling or disk I/O—outside the immediate hardware interrupt context, allowing faster and more efficient interrupt processing without blocking the system.
+
+This example usage of `mpstat` monitors CPU usage statistics, specifically focusing on SoftIRQ usage, across all CPU cores, sampled every 1 second, for 5 intervals.
+
+```shell
+mpstat -P ALL 1 5 | grep -E '(CPU|%soft|Average)'
+```
+
 ## Troubleshooting
 
 ### Timeouts

shell/Dockerfile

@@ -20,6 +20,7 @@ RUN tdnf install -y \
 	nmap \
 	nmap-ncat \
 	openssh \
+	sysstat \
 	socat \
 	tcpdump \
 	wget \