Network Monitoring Tools-Iftop

Real-time traffic monitoring tools, monitoring TCP/IP connectivity, etc., the disadvantage is no reporting function. Must be root to run.

Parameters:
-I set the monitoring network card, such as: # Iftop-i eth1
-B displays traffic in bytes (default is bits), such as: # Iftop-b
-N Causes the host information to display IP directly by default, such as: # Iftop-n
-N causes port information to be displayed by default directly, such as: # Iftop-n
-F shows incoming and outgoing traffic for a specific segment, such as # iftop-f 10.10.1.0/24 or # iftop-f 10.10.1.0/255.255.255.0
-H (Display this message), Help, display parameter information
-p after using this parameter, the middle list shows the local host information, and the IP information outside of this machine appears;
-B to display the flow graph bar by default;
-F This is not very likely to use, filter the calculation of the packet;
-P enables host information and port information to be displayed by default;
-M sets the maximum value of the top-most scale of the interface, with a scale of five large segments, for example: # iftop-m 100M

1) Perform iftop-n-n-i eth1:
19.1Mb 38.1Mb 57.2Mb 76.3Mb 95.4Mb
+-----------------+-----------------+--------------------+--------------------+---------------------
192.168.1.11 = 192.168.1.66 5.3Mb 3.22Mb 3.20Mb
<= 219kb 45.7kb 49.3kb
192.168.1.11 = 192.168.1.29 144kb 30.8kb 29.6kb
<= 11.3Mb 2.38Mb 2.74Mb
192.168.1.11 = 12.2.11.71 0b 6.40kb 6.66kb
<= 0b 0b 0b
192.168.1.11 = 192.168.1.8 2.63kb 1.43kb 932b
<= 1.31kb 1.05kb 893b
192.168.1.11 = 192.168.2.78 2.53kb 1.54kb 2.15kb
<= 160b 160b 187b
192.168.1.11 = 111.126.195.69 0b 166b 69b
<= 0b 0b 0b
------------------------------------------------------------------------------------------------------
TX:CUM:9.70MB PEAK:15.6MB RATES:15.4MB 3.26Mb 3.23Mb
RX:8.38MB 14.9Mb 11.5Mb 2.42Mb 2.79Mb
TOTAL:18.1MB 30.5Mb 27.0Mb 5.69Mb 6.03Mb
First line: Bandwidth display
Middle section: List of external connections, that is, what IP is logged and the network connection to this computer
Middle part right: The real-time parameters are the average traffic that the access IP is connected to this machine for 2 seconds, 10 seconds, and 40 seconds, respectively.
= = Sends data, <= represents the received data
Bottom three lines:
Indicates sending, receiving and all traffic
TX: Send Traffic
RX: Receive Traffic
Total: Overall flow
Cumm: Total traffic running iftop to current time
Peak: Traffic Peaks
Rates: Represents the average traffic for the past 2s 10s 40s, respectively
Through the Iftop interface it is easy to find which IP is hogging the network traffic, this is ifstat do not. However, the Iftop traffic display unit is MB, this b is bit, is bits, not bytes, and ifstat KB, this b is byte, Byte is 8 times times the bit.

2) Some operation commands after entering the Iftop screen (note case)
H toggles whether to display help;
N Toggles the display of the IP or hostname of the machine;
s toggles whether to display the host information of the machine;
D toggles whether to display host information for remote target hosts;
T toggle display format is 2 lines/1 lines/Only send traffic/show receive traffic only;
N Toggles the display port number or port service name;
S toggles whether to display the port information of the machine;
D toggles whether to display the port information of the remote target host;
P Toggles whether the port information is displayed;
P Toggle Pause/Resume display;
B Toggles whether the average flow graph bar is displayed;
B Switch calculates the average flow in 2 seconds or 10 seconds or 40 seconds;
T Toggles whether the total traffic for each connection is displayed;
L Turn on the screen filtering function, enter the characters to filter, such as IP, press ENTER, the screen will only show this IP-related traffic information;
L Toggle the top of the display screen, the scale is different, the flow graph bar will change;
J or K can scroll up or down the screen to display the connection record;
1 or 2 or 3 can be sorted according to the three-column traffic data displayed on the right;
< sort by the local name or IP on the left;
> Sort by host name or IP of the remote target host;
o The toggle is fixed to show only the current connection;
F can edit the filter code, this is translated by saying, I have not used this!
! You can use the shell command, this is useless! I don't know what the order is.
Q Exit monitoring.

Network Monitoring Tools-Iftop