iftop

iftop

Developer(s)	Paul Warren
Stable release	0.17
Written in	C
Operating system	Unix-like
Type	Bandwidth usage / System monitor
License	GNU General Public License
Website	www.ex-parrot.com/pdw/iftop/

iftop is a command-line system monitor tool that produces a frequently-updated list of network connections. By default, the connections are ordered by bandwidth usage, with only the "top" bandwidth consumers shown.

The iftop website gives the following description: "iftop does for network usage what top(1) does for CPU usage. It listens to network traffic on a named interface and displays a table of current bandwidth usage by pairs of hosts. Handy for answering the question 'why is our ADSL link so slow?'".

Description

iftop monitors to network traffic and displays a table of current bandwidth usage. An interface may be specified or, if not, it will listen on the first interface it finds which looks like an external interface. iftop must be run with sufficient permissions to monitor all network traffic; on most systems this means that it must be run as a root user, see sudo.

By default, iftop will look up hostnames associated with addresses and counts all IP packets that pass through the filter. Hostname look-up can add substantial traffic, in and of itself, and may result in an inaccurate display of network traffic. You may wish to suppress display of DNS traffic by using filter code such as "not port domain", or switch it off entirely, by using the -n option or by pressing 'n' when the program is running. Using the -F option makes it possible to show packets entering and leaving a given network.

Options

Options for the iftop command-line are listed below:

       -h     Print a summary of usage.

       -n     Don't do hostname lookups.

       -N     Do not resolve port number to service names

       -p     Run in promiscuous mode, so that traffic which does not pass directly through the specified interface is also counted.

       -P     Turn on port display.

       -l     Display and count datagrams addressed to or from link-local IPv6 addresses.  The default is not to display that address category.

       -b     Don't display bar graphs of traffic.

       -m limit
              Set the upper limit for the bandwidth scale.  Specified as a number with a 'K', 'M' or 'G' suffix.

       -B     Display bandwidth rates in bytes/sec rather than bits/sec.

       -i interface
              Listen to packets on interface.

       -f filter code
              Use filter code to select the packets to count. Only IP packets are ever counted, so the specified code is evaluated  as  (filter
              code) and ip.

       -F net/mask
              Specifies  an IPv4 network for traffic analysis.  If specified, iftop will only include packets flowing in to or out of the given
              network, and packet direction is determined relative to the network boundary, rather than to the interface.  You may specify mask
              as a dotted quad, such as /255.255.255.0, or as a single number specifying the number of bits set in the netmask, such as /24.

       -G net6/mask6
              Specifies  an  IPv6  network  for  traffic analysis. The value of mask6 can be given as a prefix length or as a numerical address
              string for more compound bitmasking.

       -c config file
              Specifies an alternate config file.  If not specified, iftop will use ~/.iftoprc if it exists.  See below for  a  description  of
              config files

       -t text output mode
              Use text interface without ncurses and print the output to STDOUT.

HELP MENU

Usage is CaSe-sensitive. h-Key will display help menu.

Host Display:                          General:
n - toggle DNS host resolution         P - pause display
s - toggle show source host            h - toggle this help display
d - toggle show destination host       b - toggle bar graph display
t - cycle line display                 B - cycle bar graph average
                                       T - toggle cumulative line totals
Port Display:                          j/k - scroll display
N - toggle service resolution          f - edit filter code
S - toggle show source port            l - set screen filter
D - toggle show destination port       L - linear/log scales
P - toggle port display                ! - shell command
                                       q - quit
Sorting:
1/2/3 - sort by 1st/2nd/3rd column     
< - sort by source name
> - sort by destination name
o - freeze current sort

See also

• top - the similar 'top' command
• netsniff-ng's ifpps top-like statistics tool
• ntop
• List of Unix programs

External links

• Official website