--- embedaddon/iftop/iftop.cat 2012/02/21 16:57:34 1.1 +++ embedaddon/iftop/iftop.cat 2016/10/18 14:04:50 1.1.1.2 @@ -2,33 +2,36 @@ IFTOP(8) +-e .pl 1100i + + NNAAMMEE iftop - display bandwidth usage on an interface by host SSYYNNOOPPSSIISS - iiffttoopp --hh | [--nnNNppbbBBPP] [--ii _i_n_t_e_r_f_a_c_e] [--ff _f_i_l_t_e_r _c_o_d_e] [--FF _n_e_t/_m_a_s_k] + iiffttoopp --hh | [--nnNNppbbllBBPP] [--ii _i_n_t_e_r_f_a_c_e] [--ff _f_i_l_t_e_r _c_o_d_e] [--FF _n_e_t/_m_a_s_k] [--GG + _n_e_t_6/_m_a_s_k_6] - DDEESSCCRRIIPPTTIIOONN - iiffttoopp listens to network traffic on a named _i_n_t_e_r_f_a_c_e, or on the first + iiffttoopp listens to network traffic on a named _i_n_t_e_r_f_a_c_e, or on the first interface it can find which looks like an external interface if none is - specified, and displays a table of current bandwidth usage by pairs of - hosts. iiffttoopp must be run with sufficient permissions to monitor all + specified, and displays a table of current bandwidth usage by pairs of + hosts. iiffttoopp must be run with sufficient permissions to monitor all network traffic on the _i_n_t_e_r_f_a_c_e; see ppccaapp(3) for more information, but on most systems this means that it must be run as root. - By default, iiffttoopp will look up the hostnames associated with addresses - it finds in packets. This can cause substantial traffic of itself, and - may result in a confusing display. You may wish to suppress display of - DNS traffic by using filter code such as nnoott ppoorrtt ddoommaaiinn, or switch it - off entirely, by using the --nn option or by pressing RR when the program + By default, iiffttoopp will look up the hostnames associated with addresses + it finds in packets. This can cause substantial traffic of itself, and + may result in a confusing display. You may wish to suppress display of + DNS traffic by using filter code such as nnoott ppoorrtt ddoommaaiinn, or switch it + off entirely, by using the --nn option or by pressing rr when the program is running. - By default, iiffttoopp counts all IP packets that pass through the filter, - and the direction of the packet is determined according to the direc- + By default, iiffttoopp counts all IP packets that pass through the filter, + and the direction of the packet is determined according to the direc- tion the packet is moving across the interface. Using the --FF option it - is possible to get iiffttoopp to show packets entering and leaving a given + is possible to get iiffttoopp to show packets entering and leaving a given network. For example, iiffttoopp --FF 1100..00..00..00//225555..00..00..00 will analyse packets flowing in and out of the 10.* network. @@ -38,11 +41,11 @@ DDEESSCCRRIIPPTTIIOONN Ignore ethernet broadcast packets. ppoorrtt hhttttpp aanndd nnoott hhoosstt _w_e_b_c_a_c_h_e_._e_x_a_m_p_l_e_._c_o_m - Count web traffic only, unless it is being directed through a + Count web traffic only, unless it is being directed through a local web cache. - iiccmmpp How much bandwith are users wasting trying to figure out why the - network is slow? + iiccmmpp How much bandwidth are users wasting trying to figure out why + the network is slow? OOPPTTIIOONNSS @@ -52,13 +55,20 @@ OOPPTTIIOONNSS --NN Do not resolve port number to service names - --pp Run in promiscuous mode, so that traffic which does not pass + --pp Run in promiscuous mode, so that traffic which does not pass directly through the specified interface is also counted. --PP Turn on port display. + --ll Display and count datagrams addressed to or from link-local IPv6 + addresses. The default is not to display that address category. + --bb Don't display bar graphs of traffic. + --mm _l_i_m_i_t + Set the upper limit for the bandwidth scale. Specified as a + number with a 'K', 'M' or 'G' suffix. + --BB Display bandwidth rates in bytes/sec rather than bits/sec. --ii _i_n_t_e_r_f_a_c_e @@ -70,19 +80,30 @@ OOPPTTIIOONNSS _c_o_d_e)) aanndd iipp. --FF _n_e_t/_m_a_s_k - Specifies a network for traffic analysis. If specified, iftop - will only include packets flowing in to or out of the given net- - work, and packet direction is determined relative to the network - boundary, rather than to the interface. You may specify _m_a_s_k as - a dotted quad, such as /255.255.255.0, or as a single number - specifying the number of bits set in the netmask, such as /24. + Specifies an IPv4 network for traffic analysis. If specified, + iftop will only include packets flowing in to or out of the + given network, and packet direction is determined relative to + the network boundary, rather than to the interface. You may + specify _m_a_s_k as a dotted quad, such as /255.255.255.0, or as a + single number specifying the number of bits set in the netmask, + such as /24. + --GG _n_e_t_6/_m_a_s_k_6 + Specifies an IPv6 network for traffic analysis. The value of + _m_a_s_k_6 can be given as a prefix length or as a numerical address + string for more compound bitmasking. + --cc _c_o_n_f_i_g _f_i_l_e - Specifies an alternate config file. If not specified, iftop - will use ~~//..iiffttoopprrcc if it exists. See below for a description + Specifies an alternate config file. If not specified, iftop + will use ~~//..iiffttoopprrcc if it exists. See below for a description of config files + --tt _t_e_x_t _o_u_t_p_u_t _m_o_d_e + Use text interface without ncurses and print the output to STD- + OUT. + + DDIISSPPLLAAYY When running, iiffttoopp uses the whole screen to display network usage. At the top of the display is a logarithmic scale for the bar graph which @@ -202,6 +223,9 @@ CCOONNFFIIGG FFIILLEE ppoorrtt--ddiissppllaayy:: _(_o_f_f_|_s_o_u_r_c_e_-_o_n_l_y_|_d_e_s_t_i_n_a_t_i_o_n_-_o_n_l_y_|_o_n_) Controls display of port numbers. + lliinnkk--llooccaall:: _(_y_e_s_|_n_o_) + Determines displaying of link-local IPv6 addresses. + hhiiddee--ssoouurrccee:: _(_y_e_s_|_n_o_) Hides source host names. @@ -218,17 +242,23 @@ CCOONNFFIIGG FFIILLEE Controls the appearance of each item in the display. sshhooww--ttoottaallss:: _(_y_e_s_|_n_o_) - Shows cummulative total for each item. + Shows cumulative total for each item. lloogg--ssccaallee:: _(_y_e_s_|_n_o_) Use a logarithmic scale for bar graphs. mmaaxx--bbaannddwwiiddtthh:: _b_w - Fixes the maximum for the bar graph scale to _b_w, e.g. "10M" + Fixes the maximum for the bar graph scale to _b_w, e.g. "10M". + Note that the value has to always be in bits, regardless if the + option to display in bytes has been chosen. nneett--ffiilltteerr:: _n_e_t_/_m_a_s_k Defines an IP network boundary for determining packet direction. + nneett--ffiilltteerr66:: _n_e_t_6_/_m_a_s_k_6 + Defines an IPv6 network boundary for determining packet direc- + tion. + ssccrreeeenn--ffiilltteerr:: _r_e_g_e_x_p Sets a regular expression to filter screen output. @@ -236,37 +266,37 @@ CCOONNFFIIGG FFIILLEE QQUUIIRRKKSS ((aakkaa tthheeyy''rree ffeeaattuurreess,, nnoott bbuuggss)) There are some circumstances in which iftop may not do what you expect. In most cases what it is doing is logical, and we believe it is correct - behaviour, although I'm happy to hear reasoned arguments for alterna- + behaviour, although I'm happy to hear reasoned arguments for alterna- tive behaviour. TToottaallss ddoonn''tt aadddd uupp There are several reasons why the totals may not appear to add up. The - most obvious is having a screen filter in effect, or screen ordering - frozen. In this case some captured information is not being shown to + most obvious is having a screen filter in effect, or screen ordering + frozen. In this case some captured information is not being shown to you, but is included in the totals. - A more subtle explanation comes about when running in promiscuous mode - without specifying a --FF option. In this case there is no easy way to - assign the direction of traffic between two third parties. For the - purposes of the main display this is done in an arbitrary fashion (by - ordering of IP addresses), but for the sake of totals all traffic + A more subtle explanation comes about when running in promiscuous mode + without specifying a --FF option. In this case there is no easy way to + assign the direction of traffic between two third parties. For the + purposes of the main display this is done in an arbitrary fashion (by + ordering of IP addresses), but for the sake of totals all traffic between other hosts is accounted as incoming, because that's what it is - from the point of view of your interface. The --FF option allows you to - specify an arbitrary network boundary, and to show traffic flowing + from the point of view of your interface. The --FF option allows you to + specify an arbitrary network boundary, and to show traffic flowing across it. PPeeaakk ttoottaallss ddoonn''tt aadddd uupp - Again, this is a feature. The peak sent and peak received didn't nec- - essarily happen at the same time. The peak total is the maximum of + Again, this is a feature. The peak sent and peak received didn't nec- + essarily happen at the same time. The peak total is the maximum of sent plus received in each captured time division. CChhaannggiinngg tthhee ffiilltteerr ccooddee ddooeessnn''tt sseeeemm ttoo wwoorrkk - Give it time. Changing the filter code affects what is captured from - the time that you entered it, but most of what is on the display is - based on some fraction of the last 40s window of capturing. After + Give it time. Changing the filter code affects what is captured from + the time that you entered it, but most of what is on the display is + based on some fraction of the last 40s window of capturing. After changing the filter there may be entries on the display that are disal- lowed by the current filter for up to 40s. DISPLAY FILTERING has imme- diate effect and does not affect what is captured. @@ -286,24 +316,25 @@ AAUUTTHHOORR VVEERRSSIIOONN - $Id: iftop.cat,v 1.1 2012/02/21 16:57:34 misho Exp $ + $Id: iftop.cat,v 1.1.1.2 2016/10/18 14:04:50 misho Exp $ CCOOPPYYIINNGG This program is free software; you can redistribute it and/or modify it - under the terms of the GNU General Public License as published by the - Free Software Foundation; either version 2 of the License, or (at your + under the terms of the GNU General Public License as published by the + Free Software Foundation; either version 2 of the License, or (at your option) any later version. - This program is distributed in the hope that it will be useful, but - WITHOUT ANY WARRANTY; without even the implied warranty of MER- - CHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General + This program is distributed in the hope that it will be useful, but + WITHOUT ANY WARRANTY; without even the implied warranty of MER- + CHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program; if not, write to the Free Software Foundation, Inc., - 675 Mass Ave, Cambridge, MA 02139, USA. + 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + (nlu+10