Annotation of embedaddon/iftop/iftop.cat, revision 1.1.1.1
1.1 misho 1: IFTOP(8) IFTOP(8)
2:
3:
4:
5: NNAAMMEE
6: iftop - display bandwidth usage on an interface by host
7:
8:
9: SSYYNNOOPPSSIISS
10: iiffttoopp --hh | [--nnNNppbbBBPP] [--ii _i_n_t_e_r_f_a_c_e] [--ff _f_i_l_t_e_r _c_o_d_e] [--FF _n_e_t/_m_a_s_k]
11:
12:
13: DDEESSCCRRIIPPTTIIOONN
14: iiffttoopp listens to network traffic on a named _i_n_t_e_r_f_a_c_e, or on the first
15: interface it can find which looks like an external interface if none is
16: specified, and displays a table of current bandwidth usage by pairs of
17: hosts. iiffttoopp must be run with sufficient permissions to monitor all
18: network traffic on the _i_n_t_e_r_f_a_c_e; see ppccaapp(3) for more information, but
19: on most systems this means that it must be run as root.
20:
21: By default, iiffttoopp will look up the hostnames associated with addresses
22: it finds in packets. This can cause substantial traffic of itself, and
23: may result in a confusing display. You may wish to suppress display of
24: DNS traffic by using filter code such as nnoott ppoorrtt ddoommaaiinn, or switch it
25: off entirely, by using the --nn option or by pressing RR when the program
26: is running.
27:
28: By default, iiffttoopp counts all IP packets that pass through the filter,
29: and the direction of the packet is determined according to the direc-
30: tion the packet is moving across the interface. Using the --FF option it
31: is possible to get iiffttoopp to show packets entering and leaving a given
32: network. For example, iiffttoopp --FF 1100..00..00..00//225555..00..00..00 will analyse packets
33: flowing in and out of the 10.* network.
34:
35: Some other filter ideas:
36:
37: nnoott eetthheerr hhoosstt ffff::ffff::ffff::ffff::ffff::ffff
38: Ignore ethernet broadcast packets.
39:
40: ppoorrtt hhttttpp aanndd nnoott hhoosstt _w_e_b_c_a_c_h_e_._e_x_a_m_p_l_e_._c_o_m
41: Count web traffic only, unless it is being directed through a
42: local web cache.
43:
44: iiccmmpp How much bandwith are users wasting trying to figure out why the
45: network is slow?
46:
47:
48: OOPPTTIIOONNSS
49: --hh Print a summary of usage.
50:
51: --nn Don't do hostname lookups.
52:
53: --NN Do not resolve port number to service names
54:
55: --pp Run in promiscuous mode, so that traffic which does not pass
56: directly through the specified interface is also counted.
57:
58: --PP Turn on port display.
59:
60: --bb Don't display bar graphs of traffic.
61:
62: --BB Display bandwidth rates in bytes/sec rather than bits/sec.
63:
64: --ii _i_n_t_e_r_f_a_c_e
65: Listen to packets on _i_n_t_e_r_f_a_c_e.
66:
67: --ff _f_i_l_t_e_r _c_o_d_e
68: Use _f_i_l_t_e_r _c_o_d_e to select the packets to count. Only IP packets
69: are ever counted, so the specified code is evaluated as ((_f_i_l_t_e_r
70: _c_o_d_e)) aanndd iipp.
71:
72: --FF _n_e_t/_m_a_s_k
73: Specifies a network for traffic analysis. If specified, iftop
74: will only include packets flowing in to or out of the given net-
75: work, and packet direction is determined relative to the network
76: boundary, rather than to the interface. You may specify _m_a_s_k as
77: a dotted quad, such as /255.255.255.0, or as a single number
78: specifying the number of bits set in the netmask, such as /24.
79:
80: --cc _c_o_n_f_i_g _f_i_l_e
81: Specifies an alternate config file. If not specified, iftop
82: will use ~~//..iiffttoopprrcc if it exists. See below for a description
83: of config files
84:
85:
86: DDIISSPPLLAAYY
87: When running, iiffttoopp uses the whole screen to display network usage. At
88: the top of the display is a logarithmic scale for the bar graph which
89: gives a visual indication of traffic.
90:
91: The main part of the display lists, for each pair of hosts, the rate at
92: which data has been sent and received over the preceding 2, 10 and 40
93: second intervals. The direction of data flow is indicated by arrows, <=
94: and =>. For instance,
95:
96: foo.example.com => bar.example.com 1Kb 500b 100b
97: <= 2Mb 2Mb 2Mb
98:
99: shows, on the first line, traffic from ffoooo..eexxaammppllee..ccoomm to bbaarr..eexxaamm--
100: ppllee..ccoomm; in the preceding 2 seconds, this averaged 1Kbit/s, around half
101: that amount over the preceding 10s, and a fifth of that over the whole
102: of the last 40s. During each of those intervals, the data sent in the
103: other direction was about 2Mbit/s. On the actual display, part of each
104: line is inverted to give a visual indication of the 10s average of
105: traffic. You might expect to see something like this where host ffoooo is
106: making repeated HTTP requests to bbaarr, which is sending data back which
107: saturates a 2Mbit/s link.
108:
109: By default, the pairs of hosts responsible for the most traffic (10
110: second average) are displayed at the top of the list.
111:
112: At the bottom of the display, various totals are shown, including peak
113: traffic over the last 40s, total traffic transferred (after filtering),
114: and total transfer rates averaged over 2s, 10s and 40s.
115:
116:
117: SSOOUURRCCEE // DDEESSTT AAGGGGRREEGGAATTIIOONN
118: By pressing ss or dd while iiffttoopp is running, all traffic for each source
119: or destination will be aggregated together. This is most useful when
120: iiffttoopp is run in promiscuous mode, or is run on a gateway machine.
121:
122:
123: PPOORRTT DDIISSPPLLAAYY
124: SS or DD toggle the display of source and destination ports respectively.
125: pp will toggle port display on/off.
126:
127:
128: DDIISSPPLLAAYY TTYYPPEE
129: tt cycles through the four line display modes; the default 2-line dis-
130: play, with sent and received traffic on separate lines, and 3 1-line
131: displays, with sent, received, or total traffic shown.
132:
133:
134: DDIISSPPLLAAYY OORRDDEERR
135: By default, the display is ordered according to the 10s average (2nd
136: column). By pressing 11, 22 or 33 it is possible to sort by the 1st, 2nd
137: or 3rd column. By pressing << or >> the display will be sorted by
138: source or destination hostname respectively.
139:
140:
141: DDIISSPPLLAAYY FFIILLTTEERRIINNGG
142: ll allows you to enter a POSIX extended regular expression that will be
143: used to filter hostnames shown in the display. This is a good way to
144: quickly limit what is shown on the display. Note that this happens at
145: a much later stage than filter code, and does not affect what is actu-
146: ally captured. Display filters DO NOT affect the totals at the bottom
147: of the screen.
148:
149:
150: PPAAUUSSEE DDIISSPPLLAAYY // FFRREEEEZZEE OORRDDEERR
151: PP will pause the current display.
152:
153: oo will freeze the current screen order. This has the side effect that
154: traffic between hosts not shown on the screen at the time will not be
155: shown at all, although it will be included in the totals at the bottom
156: of the screen.
157:
158:
159: SSCCRROOLLLL DDIISSPPLLAAYY
160: jj and kk will scroll the display of hosts. This feature is most useful
161: when the display order is frozen (see above).
162:
163:
164: FFIILLTTEERR CCOODDEE
165: ff allows you to edit the filter code whilst iftop running. This can
166: lead to some unexpected behaviour.
167:
168:
169: CCOONNFFIIGG FFIILLEE
170: iftop can read its configuration from a config file. If the --cc option
171: is not specified, iftop will attempt to read its configuration from
172: ~~//..iiffttoopprrcc, if it exists. Any command line options specified will
173: override settings in the config file.
174:
175: The config file consists of one configuration directive per line. Each
176: directive is a name value pair, for example:
177:
178: interface: eth0
179:
180: sets the network interface. The following config directives are sup-
181: ported:
182:
183:
184: iinntteerrffaaccee:: _i_f
185: Sets the network interface to _i_f.
186:
187: ddnnss--rreessoolluuttiioonn:: _(_y_e_s_|_n_o_)
188: Controls reverse lookup of IP addresses.
189:
190: ppoorrtt--rreessoolluuttiioonn:: _(_y_e_s_|_n_o_)
191: Controls conversion of port numbers to service names.
192:
193: ffiilltteerr--ccooddee:: _b_p_f
194: Sets the filter code to _b_p_f.
195:
196: sshhooww--bbaarrss:: _(_y_e_s_|_n_o_)
197: Controls display of bar graphs.
198:
199: pprroommiissccuuoouuss:: _(_y_e_s_|_n_o_)
200: Puts the interface into promiscuous mode.
201:
202: ppoorrtt--ddiissppllaayy:: _(_o_f_f_|_s_o_u_r_c_e_-_o_n_l_y_|_d_e_s_t_i_n_a_t_i_o_n_-_o_n_l_y_|_o_n_)
203: Controls display of port numbers.
204:
205: hhiiddee--ssoouurrccee:: _(_y_e_s_|_n_o_)
206: Hides source host names.
207:
208: hhiiddee--ddeessttiinnaattiioonn:: _(_y_e_s_|_n_o_)
209: Hides destination host names.
210:
211: uussee--bbyytteess:: _(_y_e_s_|_n_o_)
212: Use bytes for bandwidth display, rather than bits.
213:
214: ssoorrtt:: _(_2_s_|_1_0_s_|_4_0_s_|_s_o_u_r_c_e_|_d_e_s_t_i_n_a_t_i_o_n_)
215: Sets which column is used to sort the display.
216:
217: lliinnee--ddiissppllaayy:: _(_t_w_o_-_l_i_n_e_|_o_n_e_-_l_i_n_e_-_b_o_t_h_|_o_n_e_-_l_i_n_e_-_s_e_n_t_|_o_n_e_-_l_i_n_e_-_r_e_c_e_i_v_e_d_)
218: Controls the appearance of each item in the display.
219:
220: sshhooww--ttoottaallss:: _(_y_e_s_|_n_o_)
221: Shows cummulative total for each item.
222:
223: lloogg--ssccaallee:: _(_y_e_s_|_n_o_)
224: Use a logarithmic scale for bar graphs.
225:
226: mmaaxx--bbaannddwwiiddtthh:: _b_w
227: Fixes the maximum for the bar graph scale to _b_w, e.g. "10M"
228:
229: nneett--ffiilltteerr:: _n_e_t_/_m_a_s_k
230: Defines an IP network boundary for determining packet direction.
231:
232: ssccrreeeenn--ffiilltteerr:: _r_e_g_e_x_p
233: Sets a regular expression to filter screen output.
234:
235:
236: QQUUIIRRKKSS ((aakkaa tthheeyy''rree ffeeaattuurreess,, nnoott bbuuggss))
237: There are some circumstances in which iftop may not do what you expect.
238: In most cases what it is doing is logical, and we believe it is correct
239: behaviour, although I'm happy to hear reasoned arguments for alterna-
240: tive behaviour.
241:
242: TToottaallss ddoonn''tt aadddd uupp
243:
244: There are several reasons why the totals may not appear to add up. The
245: most obvious is having a screen filter in effect, or screen ordering
246: frozen. In this case some captured information is not being shown to
247: you, but is included in the totals.
248:
249: A more subtle explanation comes about when running in promiscuous mode
250: without specifying a --FF option. In this case there is no easy way to
251: assign the direction of traffic between two third parties. For the
252: purposes of the main display this is done in an arbitrary fashion (by
253: ordering of IP addresses), but for the sake of totals all traffic
254: between other hosts is accounted as incoming, because that's what it is
255: from the point of view of your interface. The --FF option allows you to
256: specify an arbitrary network boundary, and to show traffic flowing
257: across it.
258:
259: PPeeaakk ttoottaallss ddoonn''tt aadddd uupp
260:
261: Again, this is a feature. The peak sent and peak received didn't nec-
262: essarily happen at the same time. The peak total is the maximum of
263: sent plus received in each captured time division.
264:
265: CChhaannggiinngg tthhee ffiilltteerr ccooddee ddooeessnn''tt sseeeemm ttoo wwoorrkk
266:
267: Give it time. Changing the filter code affects what is captured from
268: the time that you entered it, but most of what is on the display is
269: based on some fraction of the last 40s window of capturing. After
270: changing the filter there may be entries on the display that are disal-
271: lowed by the current filter for up to 40s. DISPLAY FILTERING has imme-
272: diate effect and does not affect what is captured.
273:
274:
275: FFIILLEESS
276: ~~//..iiffttoopprrcc
277: Configuration file for iftop.
278:
279:
280: SSEEEE AALLSSOO
281: ttccppdduummpp(8), ppccaapp(3), ddrriiffttnneett(1).
282:
283:
284: AAUUTTHHOORR
285: Paul Warren <pdw@ex-parrot.com>
286:
287:
288: VVEERRSSIIOONN
289: $Id: iftop.8,v 1.25 2005/12/25 11:50:21 pdw Exp $
290:
291:
292: CCOOPPYYIINNGG
293: This program is free software; you can redistribute it and/or modify it
294: under the terms of the GNU General Public License as published by the
295: Free Software Foundation; either version 2 of the License, or (at your
296: option) any later version.
297:
298: This program is distributed in the hope that it will be useful, but
299: WITHOUT ANY WARRANTY; without even the implied warranty of MER-
300: CHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General
301: Public License for more details.
302:
303: You should have received a copy of the GNU General Public License along
304: with this program; if not, write to the Free Software Foundation, Inc.,
305: 675 Mass Ave, Cambridge, MA 02139, USA.
306:
307:
308:
309:
310: IFTOP(8)
FreeBSD-CVSweb <freebsd-cvsweb@FreeBSD.org>
![[BACK]](/icons/cvsweb/back.gif){kind=icon}
Return to iftop.cat CVS log ![[TXT]](/icons/cvsweb/text.gif){kind=icon}
![[DIR]](/icons/cvsweb/dir.gif){kind=icon}
Up to [ELWIX - Embedded LightWeight unIX -] / embedaddon / iftop