1: IFTOP(8) IFTOP(8)
2:
3:
4:
5: -e .pl 1100i
6:
7:
8: NNAAMMEE
9: iftop - display bandwidth usage on an interface by host
10:
11:
12: SSYYNNOOPPSSIISS
13: iiffttoopp --hh | [--nnNNppbbllBBPP] [--ii _i_n_t_e_r_f_a_c_e] [--ff _f_i_l_t_e_r _c_o_d_e] [--FF _n_e_t/_m_a_s_k] [--GG
14: _n_e_t_6/_m_a_s_k_6]
15:
16: DDEESSCCRRIIPPTTIIOONN
17: iiffttoopp listens to network traffic on a named _i_n_t_e_r_f_a_c_e, or on the first
18: interface it can find which looks like an external interface if none is
19: specified, and displays a table of current bandwidth usage by pairs of
20: hosts. iiffttoopp must be run with sufficient permissions to monitor all
21: network traffic on the _i_n_t_e_r_f_a_c_e; see ppccaapp(3) for more information, but
22: on most systems this means that it must be run as root.
23:
24: By default, iiffttoopp will look up the hostnames associated with addresses
25: it finds in packets. This can cause substantial traffic of itself, and
26: may result in a confusing display. You may wish to suppress display of
27: DNS traffic by using filter code such as nnoott ppoorrtt ddoommaaiinn, or switch it
28: off entirely, by using the --nn option or by pressing rr when the program
29: is running.
30:
31: By default, iiffttoopp counts all IP packets that pass through the filter,
32: and the direction of the packet is determined according to the direc-
33: tion the packet is moving across the interface. Using the --FF option it
34: is possible to get iiffttoopp to show packets entering and leaving a given
35: network. For example, iiffttoopp --FF 1100..00..00..00//225555..00..00..00 will analyse packets
36: flowing in and out of the 10.* network.
37:
38: Some other filter ideas:
39:
40: nnoott eetthheerr hhoosstt ffff::ffff::ffff::ffff::ffff::ffff
41: Ignore ethernet broadcast packets.
42:
43: ppoorrtt hhttttpp aanndd nnoott hhoosstt _w_e_b_c_a_c_h_e_._e_x_a_m_p_l_e_._c_o_m
44: Count web traffic only, unless it is being directed through a
45: local web cache.
46:
47: iiccmmpp How much bandwidth are users wasting trying to figure out why
48: the network is slow?
49:
50:
51: OOPPTTIIOONNSS
52: --hh Print a summary of usage.
53:
54: --nn Don't do hostname lookups.
55:
56: --NN Do not resolve port number to service names
57:
58: --pp Run in promiscuous mode, so that traffic which does not pass
59: directly through the specified interface is also counted.
60:
61: --PP Turn on port display.
62:
63: --ll Display and count datagrams addressed to or from link-local IPv6
64: addresses. The default is not to display that address category.
65:
66: --bb Don't display bar graphs of traffic.
67:
68: --mm _l_i_m_i_t
69: Set the upper limit for the bandwidth scale. Specified as a
70: number with a 'K', 'M' or 'G' suffix.
71:
72: --BB Display bandwidth rates in bytes/sec rather than bits/sec.
73:
74: --ii _i_n_t_e_r_f_a_c_e
75: Listen to packets on _i_n_t_e_r_f_a_c_e.
76:
77: --ff _f_i_l_t_e_r _c_o_d_e
78: Use _f_i_l_t_e_r _c_o_d_e to select the packets to count. Only IP packets
79: are ever counted, so the specified code is evaluated as ((_f_i_l_t_e_r
80: _c_o_d_e)) aanndd iipp.
81:
82: --FF _n_e_t/_m_a_s_k
83: Specifies an IPv4 network for traffic analysis. If specified,
84: iftop will only include packets flowing in to or out of the
85: given network, and packet direction is determined relative to
86: the network boundary, rather than to the interface. You may
87: specify _m_a_s_k as a dotted quad, such as /255.255.255.0, or as a
88: single number specifying the number of bits set in the netmask,
89: such as /24.
90:
91: --GG _n_e_t_6/_m_a_s_k_6
92: Specifies an IPv6 network for traffic analysis. The value of
93: _m_a_s_k_6 can be given as a prefix length or as a numerical address
94: string for more compound bitmasking.
95:
96: --cc _c_o_n_f_i_g _f_i_l_e
97: Specifies an alternate config file. If not specified, iftop
98: will use ~~//..iiffttoopprrcc if it exists. See below for a description
99: of config files
100:
101: --tt _t_e_x_t _o_u_t_p_u_t _m_o_d_e
102: Use text interface without ncurses and print the output to STD-
103: OUT.
104:
105:
106:
107: DDIISSPPLLAAYY
108: When running, iiffttoopp uses the whole screen to display network usage. At
109: the top of the display is a logarithmic scale for the bar graph which
110: gives a visual indication of traffic.
111:
112: The main part of the display lists, for each pair of hosts, the rate at
113: which data has been sent and received over the preceding 2, 10 and 40
114: second intervals. The direction of data flow is indicated by arrows, <=
115: and =>. For instance,
116:
117: foo.example.com => bar.example.com 1Kb 500b 100b
118: <= 2Mb 2Mb 2Mb
119:
120: shows, on the first line, traffic from ffoooo..eexxaammppllee..ccoomm to bbaarr..eexxaamm--
121: ppllee..ccoomm; in the preceding 2 seconds, this averaged 1Kbit/s, around half
122: that amount over the preceding 10s, and a fifth of that over the whole
123: of the last 40s. During each of those intervals, the data sent in the
124: other direction was about 2Mbit/s. On the actual display, part of each
125: line is inverted to give a visual indication of the 10s average of
126: traffic. You might expect to see something like this where host ffoooo is
127: making repeated HTTP requests to bbaarr, which is sending data back which
128: saturates a 2Mbit/s link.
129:
130: By default, the pairs of hosts responsible for the most traffic (10
131: second average) are displayed at the top of the list.
132:
133: At the bottom of the display, various totals are shown, including peak
134: traffic over the last 40s, total traffic transferred (after filtering),
135: and total transfer rates averaged over 2s, 10s and 40s.
136:
137:
138: SSOOUURRCCEE // DDEESSTT AAGGGGRREEGGAATTIIOONN
139: By pressing ss or dd while iiffttoopp is running, all traffic for each source
140: or destination will be aggregated together. This is most useful when
141: iiffttoopp is run in promiscuous mode, or is run on a gateway machine.
142:
143:
144: PPOORRTT DDIISSPPLLAAYY
145: SS or DD toggle the display of source and destination ports respectively.
146: pp will toggle port display on/off.
147:
148:
149: DDIISSPPLLAAYY TTYYPPEE
150: tt cycles through the four line display modes; the default 2-line dis-
151: play, with sent and received traffic on separate lines, and 3 1-line
152: displays, with sent, received, or total traffic shown.
153:
154:
155: DDIISSPPLLAAYY OORRDDEERR
156: By default, the display is ordered according to the 10s average (2nd
157: column). By pressing 11, 22 or 33 it is possible to sort by the 1st, 2nd
158: or 3rd column. By pressing << or >> the display will be sorted by
159: source or destination hostname respectively.
160:
161:
162: DDIISSPPLLAAYY FFIILLTTEERRIINNGG
163: ll allows you to enter a POSIX extended regular expression that will be
164: used to filter hostnames shown in the display. This is a good way to
165: quickly limit what is shown on the display. Note that this happens at
166: a much later stage than filter code, and does not affect what is actu-
167: ally captured. Display filters DO NOT affect the totals at the bottom
168: of the screen.
169:
170:
171: PPAAUUSSEE DDIISSPPLLAAYY // FFRREEEEZZEE OORRDDEERR
172: PP will pause the current display.
173:
174: oo will freeze the current screen order. This has the side effect that
175: traffic between hosts not shown on the screen at the time will not be
176: shown at all, although it will be included in the totals at the bottom
177: of the screen.
178:
179:
180: SSCCRROOLLLL DDIISSPPLLAAYY
181: jj and kk will scroll the display of hosts. This feature is most useful
182: when the display order is frozen (see above).
183:
184:
185: FFIILLTTEERR CCOODDEE
186: ff allows you to edit the filter code whilst iftop running. This can
187: lead to some unexpected behaviour.
188:
189:
190: CCOONNFFIIGG FFIILLEE
191: iftop can read its configuration from a config file. If the --cc option
192: is not specified, iftop will attempt to read its configuration from
193: ~~//..iiffttoopprrcc, if it exists. Any command line options specified will
194: override settings in the config file.
195:
196: The config file consists of one configuration directive per line. Each
197: directive is a name value pair, for example:
198:
199: interface: eth0
200:
201: sets the network interface. The following config directives are sup-
202: ported:
203:
204:
205: iinntteerrffaaccee:: _i_f
206: Sets the network interface to _i_f.
207:
208: ddnnss--rreessoolluuttiioonn:: _(_y_e_s_|_n_o_)
209: Controls reverse lookup of IP addresses.
210:
211: ppoorrtt--rreessoolluuttiioonn:: _(_y_e_s_|_n_o_)
212: Controls conversion of port numbers to service names.
213:
214: ffiilltteerr--ccooddee:: _b_p_f
215: Sets the filter code to _b_p_f.
216:
217: sshhooww--bbaarrss:: _(_y_e_s_|_n_o_)
218: Controls display of bar graphs.
219:
220: pprroommiissccuuoouuss:: _(_y_e_s_|_n_o_)
221: Puts the interface into promiscuous mode.
222:
223: ppoorrtt--ddiissppllaayy:: _(_o_f_f_|_s_o_u_r_c_e_-_o_n_l_y_|_d_e_s_t_i_n_a_t_i_o_n_-_o_n_l_y_|_o_n_)
224: Controls display of port numbers.
225:
226: lliinnkk--llooccaall:: _(_y_e_s_|_n_o_)
227: Determines displaying of link-local IPv6 addresses.
228:
229: hhiiddee--ssoouurrccee:: _(_y_e_s_|_n_o_)
230: Hides source host names.
231:
232: hhiiddee--ddeessttiinnaattiioonn:: _(_y_e_s_|_n_o_)
233: Hides destination host names.
234:
235: uussee--bbyytteess:: _(_y_e_s_|_n_o_)
236: Use bytes for bandwidth display, rather than bits.
237:
238: ssoorrtt:: _(_2_s_|_1_0_s_|_4_0_s_|_s_o_u_r_c_e_|_d_e_s_t_i_n_a_t_i_o_n_)
239: Sets which column is used to sort the display.
240:
241: lliinnee--ddiissppllaayy:: _(_t_w_o_-_l_i_n_e_|_o_n_e_-_l_i_n_e_-_b_o_t_h_|_o_n_e_-_l_i_n_e_-_s_e_n_t_|_o_n_e_-_l_i_n_e_-_r_e_c_e_i_v_e_d_)
242: Controls the appearance of each item in the display.
243:
244: sshhooww--ttoottaallss:: _(_y_e_s_|_n_o_)
245: Shows cumulative total for each item.
246:
247: lloogg--ssccaallee:: _(_y_e_s_|_n_o_)
248: Use a logarithmic scale for bar graphs.
249:
250: mmaaxx--bbaannddwwiiddtthh:: _b_w
251: Fixes the maximum for the bar graph scale to _b_w, e.g. "10M".
252: Note that the value has to always be in bits, regardless if the
253: option to display in bytes has been chosen.
254:
255: nneett--ffiilltteerr:: _n_e_t_/_m_a_s_k
256: Defines an IP network boundary for determining packet direction.
257:
258: nneett--ffiilltteerr66:: _n_e_t_6_/_m_a_s_k_6
259: Defines an IPv6 network boundary for determining packet direc-
260: tion.
261:
262: ssccrreeeenn--ffiilltteerr:: _r_e_g_e_x_p
263: Sets a regular expression to filter screen output.
264:
265:
266: QQUUIIRRKKSS ((aakkaa tthheeyy''rree ffeeaattuurreess,, nnoott bbuuggss))
267: There are some circumstances in which iftop may not do what you expect.
268: In most cases what it is doing is logical, and we believe it is correct
269: behaviour, although I'm happy to hear reasoned arguments for alterna-
270: tive behaviour.
271:
272: TToottaallss ddoonn''tt aadddd uupp
273:
274: There are several reasons why the totals may not appear to add up. The
275: most obvious is having a screen filter in effect, or screen ordering
276: frozen. In this case some captured information is not being shown to
277: you, but is included in the totals.
278:
279: A more subtle explanation comes about when running in promiscuous mode
280: without specifying a --FF option. In this case there is no easy way to
281: assign the direction of traffic between two third parties. For the
282: purposes of the main display this is done in an arbitrary fashion (by
283: ordering of IP addresses), but for the sake of totals all traffic
284: between other hosts is accounted as incoming, because that's what it is
285: from the point of view of your interface. The --FF option allows you to
286: specify an arbitrary network boundary, and to show traffic flowing
287: across it.
288:
289: PPeeaakk ttoottaallss ddoonn''tt aadddd uupp
290:
291: Again, this is a feature. The peak sent and peak received didn't nec-
292: essarily happen at the same time. The peak total is the maximum of
293: sent plus received in each captured time division.
294:
295: CChhaannggiinngg tthhee ffiilltteerr ccooddee ddooeessnn''tt sseeeemm ttoo wwoorrkk
296:
297: Give it time. Changing the filter code affects what is captured from
298: the time that you entered it, but most of what is on the display is
299: based on some fraction of the last 40s window of capturing. After
300: changing the filter there may be entries on the display that are disal-
301: lowed by the current filter for up to 40s. DISPLAY FILTERING has imme-
302: diate effect and does not affect what is captured.
303:
304:
305: FFIILLEESS
306: ~~//..iiffttoopprrcc
307: Configuration file for iftop.
308:
309:
310: SSEEEE AALLSSOO
311: ttccppdduummpp(8), ppccaapp(3), ddrriiffttnneett(1).
312:
313:
314: AAUUTTHHOORR
315: Paul Warren <pdw@ex-parrot.com>
316:
317:
318: VVEERRSSIIOONN
319: $Id: iftop.cat,v 1.1.1.2 2016/10/18 14:04:50 misho Exp $
320:
321:
322: CCOOPPYYIINNGG
323: This program is free software; you can redistribute it and/or modify it
324: under the terms of the GNU General Public License as published by the
325: Free Software Foundation; either version 2 of the License, or (at your
326: option) any later version.
327:
328: This program is distributed in the hope that it will be useful, but
329: WITHOUT ANY WARRANTY; without even the implied warranty of MER-
330: CHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General
331: Public License for more details.
332:
333: You should have received a copy of the GNU General Public License along
334: with this program; if not, write to the Free Software Foundation, Inc.,
335: 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
336:
337: (nlu+10
338:
339:
340:
341: IFTOP(8)
FreeBSD-CVSweb <freebsd-cvsweb@FreeBSD.org>
![[BACK]](/icons/cvsweb/back.gif){kind=icon}
Return to iftop.cat CVS log ![[TXT]](/icons/cvsweb/text.gif){kind=icon}
![[DIR]](/icons/cvsweb/dir.gif){kind=icon}
Up to [ELWIX - Embedded LightWeight unIX -] / embedaddon / iftop