最後更新: 2017-03-06

介紹

iftop 是靠 libpcap 去 monitor 的工具來.

用法

iftop -n -i interface [-f filter code] [-F net/mask]

opts:

-i interface

-n                         # Don't do hostname lookups.

-N                        # Do not resolve port number to service names

-B                        # Display bandwidth rates in bytes/sec rather than bits/sec.

Filter的選項來:

-F net/mask                   # packets flowing in to or out of the given network

-f [not] <host | ether host | icmp | port>

For Example:

iftop -n -i eth2

Keyboard

上下 scroll

j and k     上下 scroll來看其他 ip 資訊

Sorting

1, 2, 3      用 column( 2s 10s 40s ) 幾去 sort diaplay
 <             sort by source name
 >             sort by dest name

P             pause diaplay
p             顯示 port Number
t             Send only, Received only , Two lines per host
s, d         會 aggregated together 所 in/out 的 address
b             speed bar 的 on / off

Filter 設定

"l" 鍵(-F)

Screen filter, 相當於 ip filter

"f" 鍵 (-f)

其有 4 種 filter

MAC Addr Filter: ether host ff:ff:ff:ff:ff:ff

Port Filter: port http

Host Filter: host datahunter.org

icmp Filter: icmp

此外, 我們亦可以用 not, and  去串聯 filter, 如

host 192.168.1.1 and port http

filter 後效果:

firefox 原來會同時用幾個 port 去連一個 WebSite

相關