|
version 1.1.1.1, 2012/02/21 16:57:34
|
version 1.1.1.2, 2016/10/18 14:04:50
|
|
Line 2 IFTOP(8)
|
Line 2 IFTOP(8)
|
| |
|
| |
|
| |
|
| |
-e .pl 1100i |
| |
|
| |
|
| NNAAMMEE |
NNAAMMEE |
| iftop - display bandwidth usage on an interface by host |
iftop - display bandwidth usage on an interface by host |
| |
|
| |
|
| SSYYNNOOPPSSIISS |
SSYYNNOOPPSSIISS |
| iiffttoopp --hh | [--nnNNppbbBBPP] [--ii _i_n_t_e_r_f_a_c_e] [--ff _f_i_l_t_e_r _c_o_d_e] [--FF _n_e_t/_m_a_s_k] | iiffttoopp --hh | [--nnNNppbbllBBPP] [--ii _i_n_t_e_r_f_a_c_e] [--ff _f_i_l_t_e_r _c_o_d_e] [--FF _n_e_t/_m_a_s_k] [--GG |
| | _n_e_t_6/_m_a_s_k_6] |
| |
|
| |
|
| DDEESSCCRRIIPPTTIIOONN |
DDEESSCCRRIIPPTTIIOONN |
| iiffttoopp listens to network traffic on a named _i_n_t_e_r_f_a_c_e, or on the first | iiffttoopp listens to network traffic on a named _i_n_t_e_r_f_a_c_e, or on the first |
| interface it can find which looks like an external interface if none is |
interface it can find which looks like an external interface if none is |
| specified, and displays a table of current bandwidth usage by pairs of | specified, and displays a table of current bandwidth usage by pairs of |
| hosts. iiffttoopp must be run with sufficient permissions to monitor all | hosts. iiffttoopp must be run with sufficient permissions to monitor all |
| network traffic on the _i_n_t_e_r_f_a_c_e; see ppccaapp(3) for more information, but |
network traffic on the _i_n_t_e_r_f_a_c_e; see ppccaapp(3) for more information, but |
| on most systems this means that it must be run as root. |
on most systems this means that it must be run as root. |
| |
|
| By default, iiffttoopp will look up the hostnames associated with addresses | By default, iiffttoopp will look up the hostnames associated with addresses |
| it finds in packets. This can cause substantial traffic of itself, and | it finds in packets. This can cause substantial traffic of itself, and |
| may result in a confusing display. You may wish to suppress display of | may result in a confusing display. You may wish to suppress display of |
| DNS traffic by using filter code such as nnoott ppoorrtt ddoommaaiinn, or switch it | DNS traffic by using filter code such as nnoott ppoorrtt ddoommaaiinn, or switch it |
| off entirely, by using the --nn option or by pressing RR when the program | off entirely, by using the --nn option or by pressing rr when the program |
| is running. |
is running. |
| |
|
| By default, iiffttoopp counts all IP packets that pass through the filter, | By default, iiffttoopp counts all IP packets that pass through the filter, |
| and the direction of the packet is determined according to the direc- | and the direction of the packet is determined according to the direc- |
| tion the packet is moving across the interface. Using the --FF option it |
tion the packet is moving across the interface. Using the --FF option it |
| is possible to get iiffttoopp to show packets entering and leaving a given | is possible to get iiffttoopp to show packets entering and leaving a given |
| network. For example, iiffttoopp --FF 1100..00..00..00//225555..00..00..00 will analyse packets |
network. For example, iiffttoopp --FF 1100..00..00..00//225555..00..00..00 will analyse packets |
| flowing in and out of the 10.* network. |
flowing in and out of the 10.* network. |
| |
|
|
Line 38 DDEESSCCRRIIPPTTIIOONN
|
Line 41 DDEESSCCRRIIPPTTIIOONN
|
| Ignore ethernet broadcast packets. |
Ignore ethernet broadcast packets. |
| |
|
| ppoorrtt hhttttpp aanndd nnoott hhoosstt _w_e_b_c_a_c_h_e_._e_x_a_m_p_l_e_._c_o_m |
ppoorrtt hhttttpp aanndd nnoott hhoosstt _w_e_b_c_a_c_h_e_._e_x_a_m_p_l_e_._c_o_m |
| Count web traffic only, unless it is being directed through a | Count web traffic only, unless it is being directed through a |
| local web cache. |
local web cache. |
| |
|
| iiccmmpp How much bandwith are users wasting trying to figure out why the | iiccmmpp How much bandwidth are users wasting trying to figure out why |
| network is slow? | the network is slow? |
| |
|
| |
|
| OOPPTTIIOONNSS |
OOPPTTIIOONNSS |
|
Line 52 OOPPTTIIOONNSS
|
Line 55 OOPPTTIIOONNSS
|
| |
|
| --NN Do not resolve port number to service names |
--NN Do not resolve port number to service names |
| |
|
| --pp Run in promiscuous mode, so that traffic which does not pass | --pp Run in promiscuous mode, so that traffic which does not pass |
| directly through the specified interface is also counted. |
directly through the specified interface is also counted. |
| |
|
| --PP Turn on port display. |
--PP Turn on port display. |
| |
|
| |
--ll Display and count datagrams addressed to or from link-local IPv6 |
| |
addresses. The default is not to display that address category. |
| |
|
| --bb Don't display bar graphs of traffic. |
--bb Don't display bar graphs of traffic. |
| |
|
| |
--mm _l_i_m_i_t |
| |
Set the upper limit for the bandwidth scale. Specified as a |
| |
number with a 'K', 'M' or 'G' suffix. |
| |
|
| --BB Display bandwidth rates in bytes/sec rather than bits/sec. |
--BB Display bandwidth rates in bytes/sec rather than bits/sec. |
| |
|
| --ii _i_n_t_e_r_f_a_c_e |
--ii _i_n_t_e_r_f_a_c_e |
|
Line 70 OOPPTTIIOONNSS
|
Line 80 OOPPTTIIOONNSS
|
| _c_o_d_e)) aanndd iipp. |
_c_o_d_e)) aanndd iipp. |
| |
|
| --FF _n_e_t/_m_a_s_k |
--FF _n_e_t/_m_a_s_k |
| Specifies a network for traffic analysis. If specified, iftop | Specifies an IPv4 network for traffic analysis. If specified, |
| will only include packets flowing in to or out of the given net- | iftop will only include packets flowing in to or out of the |
| work, and packet direction is determined relative to the network | given network, and packet direction is determined relative to |
| boundary, rather than to the interface. You may specify _m_a_s_k as | the network boundary, rather than to the interface. You may |
| a dotted quad, such as /255.255.255.0, or as a single number | specify _m_a_s_k as a dotted quad, such as /255.255.255.0, or as a |
| specifying the number of bits set in the netmask, such as /24. | single number specifying the number of bits set in the netmask, |
| | such as /24. |
| |
|
| |
--GG _n_e_t_6/_m_a_s_k_6 |
| |
Specifies an IPv6 network for traffic analysis. The value of |
| |
_m_a_s_k_6 can be given as a prefix length or as a numerical address |
| |
string for more compound bitmasking. |
| |
|
| --cc _c_o_n_f_i_g _f_i_l_e |
--cc _c_o_n_f_i_g _f_i_l_e |
| Specifies an alternate config file. If not specified, iftop | Specifies an alternate config file. If not specified, iftop |
| will use ~~//..iiffttoopprrcc if it exists. See below for a description | will use ~~//..iiffttoopprrcc if it exists. See below for a description |
| of config files |
of config files |
| |
|
| |
--tt _t_e_x_t _o_u_t_p_u_t _m_o_d_e |
| |
Use text interface without ncurses and print the output to STD- |
| |
OUT. |
| |
|
| |
|
| |
|
| DDIISSPPLLAAYY |
DDIISSPPLLAAYY |
| When running, iiffttoopp uses the whole screen to display network usage. At |
When running, iiffttoopp uses the whole screen to display network usage. At |
| the top of the display is a logarithmic scale for the bar graph which |
the top of the display is a logarithmic scale for the bar graph which |
|
Line 202 CCOONNFFIIGG FFIILLEE
|
Line 223 CCOONNFFIIGG FFIILLEE
|
| ppoorrtt--ddiissppllaayy:: _(_o_f_f_|_s_o_u_r_c_e_-_o_n_l_y_|_d_e_s_t_i_n_a_t_i_o_n_-_o_n_l_y_|_o_n_) |
ppoorrtt--ddiissppllaayy:: _(_o_f_f_|_s_o_u_r_c_e_-_o_n_l_y_|_d_e_s_t_i_n_a_t_i_o_n_-_o_n_l_y_|_o_n_) |
| Controls display of port numbers. |
Controls display of port numbers. |
| |
|
| |
lliinnkk--llooccaall:: _(_y_e_s_|_n_o_) |
| |
Determines displaying of link-local IPv6 addresses. |
| |
|
| hhiiddee--ssoouurrccee:: _(_y_e_s_|_n_o_) |
hhiiddee--ssoouurrccee:: _(_y_e_s_|_n_o_) |
| Hides source host names. |
Hides source host names. |
| |
|
|
Line 218 CCOONNFFIIGG FFIILLEE
|
Line 242 CCOONNFFIIGG FFIILLEE
|
| Controls the appearance of each item in the display. |
Controls the appearance of each item in the display. |
| |
|
| sshhooww--ttoottaallss:: _(_y_e_s_|_n_o_) |
sshhooww--ttoottaallss:: _(_y_e_s_|_n_o_) |
| Shows cummulative total for each item. | Shows cumulative total for each item. |
| |
|
| lloogg--ssccaallee:: _(_y_e_s_|_n_o_) |
lloogg--ssccaallee:: _(_y_e_s_|_n_o_) |
| Use a logarithmic scale for bar graphs. |
Use a logarithmic scale for bar graphs. |
| |
|
| mmaaxx--bbaannddwwiiddtthh:: _b_w |
mmaaxx--bbaannddwwiiddtthh:: _b_w |
| Fixes the maximum for the bar graph scale to _b_w, e.g. "10M" | Fixes the maximum for the bar graph scale to _b_w, e.g. "10M". |
| | Note that the value has to always be in bits, regardless if the |
| | option to display in bytes has been chosen. |
| |
|
| nneett--ffiilltteerr:: _n_e_t_/_m_a_s_k |
nneett--ffiilltteerr:: _n_e_t_/_m_a_s_k |
| Defines an IP network boundary for determining packet direction. |
Defines an IP network boundary for determining packet direction. |
| |
|
| |
nneett--ffiilltteerr66:: _n_e_t_6_/_m_a_s_k_6 |
| |
Defines an IPv6 network boundary for determining packet direc- |
| |
tion. |
| |
|
| ssccrreeeenn--ffiilltteerr:: _r_e_g_e_x_p |
ssccrreeeenn--ffiilltteerr:: _r_e_g_e_x_p |
| Sets a regular expression to filter screen output. |
Sets a regular expression to filter screen output. |
| |
|
|
Line 236 CCOONNFFIIGG FFIILLEE
|
Line 266 CCOONNFFIIGG FFIILLEE
|
| QQUUIIRRKKSS ((aakkaa tthheeyy''rree ffeeaattuurreess,, nnoott bbuuggss)) |
QQUUIIRRKKSS ((aakkaa tthheeyy''rree ffeeaattuurreess,, nnoott bbuuggss)) |
| There are some circumstances in which iftop may not do what you expect. |
There are some circumstances in which iftop may not do what you expect. |
| In most cases what it is doing is logical, and we believe it is correct |
In most cases what it is doing is logical, and we believe it is correct |
| behaviour, although I'm happy to hear reasoned arguments for alterna- | behaviour, although I'm happy to hear reasoned arguments for alterna- |
| tive behaviour. |
tive behaviour. |
| |
|
| TToottaallss ddoonn''tt aadddd uupp |
TToottaallss ddoonn''tt aadddd uupp |
| |
|
| There are several reasons why the totals may not appear to add up. The |
There are several reasons why the totals may not appear to add up. The |
| most obvious is having a screen filter in effect, or screen ordering | most obvious is having a screen filter in effect, or screen ordering |
| frozen. In this case some captured information is not being shown to | frozen. In this case some captured information is not being shown to |
| you, but is included in the totals. |
you, but is included in the totals. |
| |
|
| A more subtle explanation comes about when running in promiscuous mode | A more subtle explanation comes about when running in promiscuous mode |
| without specifying a --FF option. In this case there is no easy way to | without specifying a --FF option. In this case there is no easy way to |
| assign the direction of traffic between two third parties. For the | assign the direction of traffic between two third parties. For the |
| purposes of the main display this is done in an arbitrary fashion (by | purposes of the main display this is done in an arbitrary fashion (by |
| ordering of IP addresses), but for the sake of totals all traffic | ordering of IP addresses), but for the sake of totals all traffic |
| between other hosts is accounted as incoming, because that's what it is |
between other hosts is accounted as incoming, because that's what it is |
| from the point of view of your interface. The --FF option allows you to | from the point of view of your interface. The --FF option allows you to |
| specify an arbitrary network boundary, and to show traffic flowing | specify an arbitrary network boundary, and to show traffic flowing |
| across it. |
across it. |
| |
|
| PPeeaakk ttoottaallss ddoonn''tt aadddd uupp |
PPeeaakk ttoottaallss ddoonn''tt aadddd uupp |
| |
|
| Again, this is a feature. The peak sent and peak received didn't nec- | Again, this is a feature. The peak sent and peak received didn't nec- |
| essarily happen at the same time. The peak total is the maximum of | essarily happen at the same time. The peak total is the maximum of |
| sent plus received in each captured time division. |
sent plus received in each captured time division. |
| |
|
| CChhaannggiinngg tthhee ffiilltteerr ccooddee ddooeessnn''tt sseeeemm ttoo wwoorrkk |
CChhaannggiinngg tthhee ffiilltteerr ccooddee ddooeessnn''tt sseeeemm ttoo wwoorrkk |
| |
|
| Give it time. Changing the filter code affects what is captured from | Give it time. Changing the filter code affects what is captured from |
| the time that you entered it, but most of what is on the display is | the time that you entered it, but most of what is on the display is |
| based on some fraction of the last 40s window of capturing. After | based on some fraction of the last 40s window of capturing. After |
| changing the filter there may be entries on the display that are disal- |
changing the filter there may be entries on the display that are disal- |
| lowed by the current filter for up to 40s. DISPLAY FILTERING has imme- |
lowed by the current filter for up to 40s. DISPLAY FILTERING has imme- |
| diate effect and does not affect what is captured. |
diate effect and does not affect what is captured. |
|
Line 291 VVEERRSSIIOONN
|
Line 321 VVEERRSSIIOONN
|
| |
|
| CCOOPPYYIINNGG |
CCOOPPYYIINNGG |
| This program is free software; you can redistribute it and/or modify it |
This program is free software; you can redistribute it and/or modify it |
| under the terms of the GNU General Public License as published by the | under the terms of the GNU General Public License as published by the |
| Free Software Foundation; either version 2 of the License, or (at your | Free Software Foundation; either version 2 of the License, or (at your |
| option) any later version. |
option) any later version. |
| |
|
| This program is distributed in the hope that it will be useful, but | This program is distributed in the hope that it will be useful, but |
| WITHOUT ANY WARRANTY; without even the implied warranty of MER- | WITHOUT ANY WARRANTY; without even the implied warranty of MER- |
| CHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General | CHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General |
| Public License for more details. |
Public License for more details. |
| |
|
| You should have received a copy of the GNU General Public License along |
You should have received a copy of the GNU General Public License along |
| with this program; if not, write to the Free Software Foundation, Inc., |
with this program; if not, write to the Free Software Foundation, Inc., |
| 675 Mass Ave, Cambridge, MA 02139, USA. | 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. |
| |
|
| |
(nlu+10 |
| |
|
| |
|
| |
|
![[BACK]](/icons/cvsweb/back.gif){kind=icon}
Return to iftop.cat CVS log ![[TXT]](/icons/cvsweb/text.gif){kind=icon}
![[DIR]](/icons/cvsweb/dir.gif){kind=icon}
Up to [ELWIX - Embedded LightWeight unIX -] / embedaddon / iftop