Annotation of embedaddon/iftop/iftop.cat, revision 1.1
1.1 ! misho 1: IFTOP(8) IFTOP(8)
! 2:
! 3:
! 4:
! 5: NNAAMMEE
! 6: iftop - display bandwidth usage on an interface by host
! 7:
! 8:
! 9: SSYYNNOOPPSSIISS
! 10: iiffttoopp --hh | [--nnNNppbbBBPP] [--ii _i_n_t_e_r_f_a_c_e] [--ff _f_i_l_t_e_r _c_o_d_e] [--FF _n_e_t/_m_a_s_k]
! 11:
! 12:
! 13: DDEESSCCRRIIPPTTIIOONN
! 14: iiffttoopp listens to network traffic on a named _i_n_t_e_r_f_a_c_e, or on the first
! 15: interface it can find which looks like an external interface if none is
! 16: specified, and displays a table of current bandwidth usage by pairs of
! 17: hosts. iiffttoopp must be run with sufficient permissions to monitor all
! 18: network traffic on the _i_n_t_e_r_f_a_c_e; see ppccaapp(3) for more information, but
! 19: on most systems this means that it must be run as root.
! 20:
! 21: By default, iiffttoopp will look up the hostnames associated with addresses
! 22: it finds in packets. This can cause substantial traffic of itself, and
! 23: may result in a confusing display. You may wish to suppress display of
! 24: DNS traffic by using filter code such as nnoott ppoorrtt ddoommaaiinn, or switch it
! 25: off entirely, by using the --nn option or by pressing RR when the program
! 26: is running.
! 27:
! 28: By default, iiffttoopp counts all IP packets that pass through the filter,
! 29: and the direction of the packet is determined according to the direc-
! 30: tion the packet is moving across the interface. Using the --FF option it
! 31: is possible to get iiffttoopp to show packets entering and leaving a given
! 32: network. For example, iiffttoopp --FF 1100..00..00..00//225555..00..00..00 will analyse packets
! 33: flowing in and out of the 10.* network.
! 34:
! 35: Some other filter ideas:
! 36:
! 37: nnoott eetthheerr hhoosstt ffff::ffff::ffff::ffff::ffff::ffff
! 38: Ignore ethernet broadcast packets.
! 39:
! 40: ppoorrtt hhttttpp aanndd nnoott hhoosstt _w_e_b_c_a_c_h_e_._e_x_a_m_p_l_e_._c_o_m
! 41: Count web traffic only, unless it is being directed through a
! 42: local web cache.
! 43:
! 44: iiccmmpp How much bandwith are users wasting trying to figure out why the
! 45: network is slow?
! 46:
! 47:
! 48: OOPPTTIIOONNSS
! 49: --hh Print a summary of usage.
! 50:
! 51: --nn Don't do hostname lookups.
! 52:
! 53: --NN Do not resolve port number to service names
! 54:
! 55: --pp Run in promiscuous mode, so that traffic which does not pass
! 56: directly through the specified interface is also counted.
! 57:
! 58: --PP Turn on port display.
! 59:
! 60: --bb Don't display bar graphs of traffic.
! 61:
! 62: --BB Display bandwidth rates in bytes/sec rather than bits/sec.
! 63:
! 64: --ii _i_n_t_e_r_f_a_c_e
! 65: Listen to packets on _i_n_t_e_r_f_a_c_e.
! 66:
! 67: --ff _f_i_l_t_e_r _c_o_d_e
! 68: Use _f_i_l_t_e_r _c_o_d_e to select the packets to count. Only IP packets
! 69: are ever counted, so the specified code is evaluated as ((_f_i_l_t_e_r
! 70: _c_o_d_e)) aanndd iipp.
! 71:
! 72: --FF _n_e_t/_m_a_s_k
! 73: Specifies a network for traffic analysis. If specified, iftop
! 74: will only include packets flowing in to or out of the given net-
! 75: work, and packet direction is determined relative to the network
! 76: boundary, rather than to the interface. You may specify _m_a_s_k as
! 77: a dotted quad, such as /255.255.255.0, or as a single number
! 78: specifying the number of bits set in the netmask, such as /24.
! 79:
! 80: --cc _c_o_n_f_i_g _f_i_l_e
! 81: Specifies an alternate config file. If not specified, iftop
! 82: will use ~~//..iiffttoopprrcc if it exists. See below for a description
! 83: of config files
! 84:
! 85:
! 86: DDIISSPPLLAAYY
! 87: When running, iiffttoopp uses the whole screen to display network usage. At
! 88: the top of the display is a logarithmic scale for the bar graph which
! 89: gives a visual indication of traffic.
! 90:
! 91: The main part of the display lists, for each pair of hosts, the rate at
! 92: which data has been sent and received over the preceding 2, 10 and 40
! 93: second intervals. The direction of data flow is indicated by arrows, <=
! 94: and =>. For instance,
! 95:
! 96: foo.example.com => bar.example.com 1Kb 500b 100b
! 97: <= 2Mb 2Mb 2Mb
! 98:
! 99: shows, on the first line, traffic from ffoooo..eexxaammppllee..ccoomm to bbaarr..eexxaamm--
! 100: ppllee..ccoomm; in the preceding 2 seconds, this averaged 1Kbit/s, around half
! 101: that amount over the preceding 10s, and a fifth of that over the whole
! 102: of the last 40s. During each of those intervals, the data sent in the
! 103: other direction was about 2Mbit/s. On the actual display, part of each
! 104: line is inverted to give a visual indication of the 10s average of
! 105: traffic. You might expect to see something like this where host ffoooo is
! 106: making repeated HTTP requests to bbaarr, which is sending data back which
! 107: saturates a 2Mbit/s link.
! 108:
! 109: By default, the pairs of hosts responsible for the most traffic (10
! 110: second average) are displayed at the top of the list.
! 111:
! 112: At the bottom of the display, various totals are shown, including peak
! 113: traffic over the last 40s, total traffic transferred (after filtering),
! 114: and total transfer rates averaged over 2s, 10s and 40s.
! 115:
! 116:
! 117: SSOOUURRCCEE // DDEESSTT AAGGGGRREEGGAATTIIOONN
! 118: By pressing ss or dd while iiffttoopp is running, all traffic for each source
! 119: or destination will be aggregated together. This is most useful when
! 120: iiffttoopp is run in promiscuous mode, or is run on a gateway machine.
! 121:
! 122:
! 123: PPOORRTT DDIISSPPLLAAYY
! 124: SS or DD toggle the display of source and destination ports respectively.
! 125: pp will toggle port display on/off.
! 126:
! 127:
! 128: DDIISSPPLLAAYY TTYYPPEE
! 129: tt cycles through the four line display modes; the default 2-line dis-
! 130: play, with sent and received traffic on separate lines, and 3 1-line
! 131: displays, with sent, received, or total traffic shown.
! 132:
! 133:
! 134: DDIISSPPLLAAYY OORRDDEERR
! 135: By default, the display is ordered according to the 10s average (2nd
! 136: column). By pressing 11, 22 or 33 it is possible to sort by the 1st, 2nd
! 137: or 3rd column. By pressing << or >> the display will be sorted by
! 138: source or destination hostname respectively.
! 139:
! 140:
! 141: DDIISSPPLLAAYY FFIILLTTEERRIINNGG
! 142: ll allows you to enter a POSIX extended regular expression that will be
! 143: used to filter hostnames shown in the display. This is a good way to
! 144: quickly limit what is shown on the display. Note that this happens at
! 145: a much later stage than filter code, and does not affect what is actu-
! 146: ally captured. Display filters DO NOT affect the totals at the bottom
! 147: of the screen.
! 148:
! 149:
! 150: PPAAUUSSEE DDIISSPPLLAAYY // FFRREEEEZZEE OORRDDEERR
! 151: PP will pause the current display.
! 152:
! 153: oo will freeze the current screen order. This has the side effect that
! 154: traffic between hosts not shown on the screen at the time will not be
! 155: shown at all, although it will be included in the totals at the bottom
! 156: of the screen.
! 157:
! 158:
! 159: SSCCRROOLLLL DDIISSPPLLAAYY
! 160: jj and kk will scroll the display of hosts. This feature is most useful
! 161: when the display order is frozen (see above).
! 162:
! 163:
! 164: FFIILLTTEERR CCOODDEE
! 165: ff allows you to edit the filter code whilst iftop running. This can
! 166: lead to some unexpected behaviour.
! 167:
! 168:
! 169: CCOONNFFIIGG FFIILLEE
! 170: iftop can read its configuration from a config file. If the --cc option
! 171: is not specified, iftop will attempt to read its configuration from
! 172: ~~//..iiffttoopprrcc, if it exists. Any command line options specified will
! 173: override settings in the config file.
! 174:
! 175: The config file consists of one configuration directive per line. Each
! 176: directive is a name value pair, for example:
! 177:
! 178: interface: eth0
! 179:
! 180: sets the network interface. The following config directives are sup-
! 181: ported:
! 182:
! 183:
! 184: iinntteerrffaaccee:: _i_f
! 185: Sets the network interface to _i_f.
! 186:
! 187: ddnnss--rreessoolluuttiioonn:: _(_y_e_s_|_n_o_)
! 188: Controls reverse lookup of IP addresses.
! 189:
! 190: ppoorrtt--rreessoolluuttiioonn:: _(_y_e_s_|_n_o_)
! 191: Controls conversion of port numbers to service names.
! 192:
! 193: ffiilltteerr--ccooddee:: _b_p_f
! 194: Sets the filter code to _b_p_f.
! 195:
! 196: sshhooww--bbaarrss:: _(_y_e_s_|_n_o_)
! 197: Controls display of bar graphs.
! 198:
! 199: pprroommiissccuuoouuss:: _(_y_e_s_|_n_o_)
! 200: Puts the interface into promiscuous mode.
! 201:
! 202: ppoorrtt--ddiissppllaayy:: _(_o_f_f_|_s_o_u_r_c_e_-_o_n_l_y_|_d_e_s_t_i_n_a_t_i_o_n_-_o_n_l_y_|_o_n_)
! 203: Controls display of port numbers.
! 204:
! 205: hhiiddee--ssoouurrccee:: _(_y_e_s_|_n_o_)
! 206: Hides source host names.
! 207:
! 208: hhiiddee--ddeessttiinnaattiioonn:: _(_y_e_s_|_n_o_)
! 209: Hides destination host names.
! 210:
! 211: uussee--bbyytteess:: _(_y_e_s_|_n_o_)
! 212: Use bytes for bandwidth display, rather than bits.
! 213:
! 214: ssoorrtt:: _(_2_s_|_1_0_s_|_4_0_s_|_s_o_u_r_c_e_|_d_e_s_t_i_n_a_t_i_o_n_)
! 215: Sets which column is used to sort the display.
! 216:
! 217: lliinnee--ddiissppllaayy:: _(_t_w_o_-_l_i_n_e_|_o_n_e_-_l_i_n_e_-_b_o_t_h_|_o_n_e_-_l_i_n_e_-_s_e_n_t_|_o_n_e_-_l_i_n_e_-_r_e_c_e_i_v_e_d_)
! 218: Controls the appearance of each item in the display.
! 219:
! 220: sshhooww--ttoottaallss:: _(_y_e_s_|_n_o_)
! 221: Shows cummulative total for each item.
! 222:
! 223: lloogg--ssccaallee:: _(_y_e_s_|_n_o_)
! 224: Use a logarithmic scale for bar graphs.
! 225:
! 226: mmaaxx--bbaannddwwiiddtthh:: _b_w
! 227: Fixes the maximum for the bar graph scale to _b_w, e.g. "10M"
! 228:
! 229: nneett--ffiilltteerr:: _n_e_t_/_m_a_s_k
! 230: Defines an IP network boundary for determining packet direction.
! 231:
! 232: ssccrreeeenn--ffiilltteerr:: _r_e_g_e_x_p
! 233: Sets a regular expression to filter screen output.
! 234:
! 235:
! 236: QQUUIIRRKKSS ((aakkaa tthheeyy''rree ffeeaattuurreess,, nnoott bbuuggss))
! 237: There are some circumstances in which iftop may not do what you expect.
! 238: In most cases what it is doing is logical, and we believe it is correct
! 239: behaviour, although I'm happy to hear reasoned arguments for alterna-
! 240: tive behaviour.
! 241:
! 242: TToottaallss ddoonn''tt aadddd uupp
! 243:
! 244: There are several reasons why the totals may not appear to add up. The
! 245: most obvious is having a screen filter in effect, or screen ordering
! 246: frozen. In this case some captured information is not being shown to
! 247: you, but is included in the totals.
! 248:
! 249: A more subtle explanation comes about when running in promiscuous mode
! 250: without specifying a --FF option. In this case there is no easy way to
! 251: assign the direction of traffic between two third parties. For the
! 252: purposes of the main display this is done in an arbitrary fashion (by
! 253: ordering of IP addresses), but for the sake of totals all traffic
! 254: between other hosts is accounted as incoming, because that's what it is
! 255: from the point of view of your interface. The --FF option allows you to
! 256: specify an arbitrary network boundary, and to show traffic flowing
! 257: across it.
! 258:
! 259: PPeeaakk ttoottaallss ddoonn''tt aadddd uupp
! 260:
! 261: Again, this is a feature. The peak sent and peak received didn't nec-
! 262: essarily happen at the same time. The peak total is the maximum of
! 263: sent plus received in each captured time division.
! 264:
! 265: CChhaannggiinngg tthhee ffiilltteerr ccooddee ddooeessnn''tt sseeeemm ttoo wwoorrkk
! 266:
! 267: Give it time. Changing the filter code affects what is captured from
! 268: the time that you entered it, but most of what is on the display is
! 269: based on some fraction of the last 40s window of capturing. After
! 270: changing the filter there may be entries on the display that are disal-
! 271: lowed by the current filter for up to 40s. DISPLAY FILTERING has imme-
! 272: diate effect and does not affect what is captured.
! 273:
! 274:
! 275: FFIILLEESS
! 276: ~~//..iiffttoopprrcc
! 277: Configuration file for iftop.
! 278:
! 279:
! 280: SSEEEE AALLSSOO
! 281: ttccppdduummpp(8), ppccaapp(3), ddrriiffttnneett(1).
! 282:
! 283:
! 284: AAUUTTHHOORR
! 285: Paul Warren <pdw@ex-parrot.com>
! 286:
! 287:
! 288: VVEERRSSIIOONN
! 289: $Id: iftop.8,v 1.25 2005/12/25 11:50:21 pdw Exp $
! 290:
! 291:
! 292: CCOOPPYYIINNGG
! 293: This program is free software; you can redistribute it and/or modify it
! 294: under the terms of the GNU General Public License as published by the
! 295: Free Software Foundation; either version 2 of the License, or (at your
! 296: option) any later version.
! 297:
! 298: This program is distributed in the hope that it will be useful, but
! 299: WITHOUT ANY WARRANTY; without even the implied warranty of MER-
! 300: CHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General
! 301: Public License for more details.
! 302:
! 303: You should have received a copy of the GNU General Public License along
! 304: with this program; if not, write to the Free Software Foundation, Inc.,
! 305: 675 Mass Ave, Cambridge, MA 02139, USA.
! 306:
! 307:
! 308:
! 309:
! 310: IFTOP(8)
FreeBSD-CVSweb <freebsd-cvsweb@FreeBSD.org>
![[BACK]](/icons/cvsweb/back.gif){kind=icon}
Return to iftop.cat CVS log ![[TXT]](/icons/cvsweb/text.gif){kind=icon}
![[DIR]](/icons/cvsweb/dir.gif){kind=icon}
Up to [ELWIX - Embedded LightWeight unIX -] / embedaddon / iftop