||This article's tone or style may not reflect the encyclopedic tone used on Wikipedia. (August 2012)|
|Type||Bandwidth usage / System monitor|
|License||GNU General Public License|
iftop is a command-line system monitor tool that produces a frequently-updated list of network connections. By default, the connections are ordered by bandwidth usage, with only the "top" bandwidth consumers shown.
The iftop website gives the following description: "iftop does for network usage what top(1) does for CPU usage. It listens to network traffic on a named interface and displays a table of current bandwidth usage by pairs of hosts. Handy for answering the question 'why is our ADSL link so slow?'".
iftop monitors to network traffic and displays a table of current bandwidth usage. An interface may be specified or, if not, it will listen on the first interface it finds which looks like an external interface. iftop must be run with sufficient permissions to monitor all network traffic; on most systems this means that it must be run as a root user, see sudo.
By default, iftop will look up hostnames associated with addresses and counts all IP packets that pass through the filter. Hostname look-up can add substantial traffic, in and of itself, and may result in an inaccurate display of network traffic. You may wish to suppress display of DNS traffic by using filter code such as "not port domain", or switch it off entirely, by using the -n option or by pressing 'n' when the program is running. Using the -F option makes it possible to show packets entering and leaving a given network.
Options for the iftop command-line are listed below:
-h Print a summary of usage. -n Don't do hostname lookups. -N Do not resolve port number to service names -p Run in promiscuous mode, so that traffic which does not pass directly through the specified interface is also counted. -P Turn on port display. -l Display and count datagrams addressed to or from link-local IPv6 addresses. The default is not to display that address category. -b Don't display bar graphs of traffic. -m limit Set the upper limit for the bandwidth scale. Specified as a number with a 'K', 'M' or 'G' suffix. -B Display bandwidth rates in bytes/sec rather than bits/sec. -i interface Listen to packets on interface. -f filter code Use filter code to select the packets to count. Only IP packets are ever counted, so the specified code is evaluated as (filter code) and ip. -F net/mask Specifies an IPv4 network for traffic analysis. If specified, iftop will only include packets flowing in to or out of the given network, and packet direction is determined relative to the network boundary, rather than to the interface. You may specify mask as a dotted quad, such as /255.255.255.0, or as a single number specifying the number of bits set in the netmask, such as /24. -G net6/mask6 Specifies an IPv6 network for traffic analysis. The value of mask6 can be given as a prefix length or as a numerical address string for more compound bitmasking. -c config file Specifies an alternate config file. If not specified, iftop will use ~/.iftoprc if it exists. See below for a description of config files -t text output mode Use text interface without ncurses and print the output to STDOUT.
Usage is CaSe-sensitive. h-Key will display help menu.
Host Display: General: n - toggle DNS host resolution P - pause display s - toggle show source host h - toggle this help display d - toggle show destination host b - toggle bar graph display t - cycle line display B - cycle bar graph average T - toggle cumulative line totals Port Display: j/k - scroll display N - toggle service resolution f - edit filter code S - toggle show source port l - set screen filter D - toggle show destination port L - linear/log scales P - toggle port display ! - shell command q - quit Sorting: 1/2/3 - sort by 1st/2nd/3rd column < - sort by source name > - sort by destination name o - freeze current sort
top- the similar 'top' command
- netsniff-ng's ifpps top-like statistics tool
- List of Unix programs