IPTraf User’s Manual. Copyright © , by Gerard Paul Java. Version 0 Preparing to Use IPTraf · Number Display Notations · Instances and Logging . iptraf is an ncurses-based IP LAN monitor that generates various network Frederic Peters ([email protected]), using iptraf –help General manual page. IPTraf User’s Manual IPTraf has a few optional command-line parameters. As with most UNIX commands, IPTraf command-line parameters are case-sensitive .

Author: Sanos Malall
Country: Kuwait
Language: English (Spanish)
Genre: Career
Published (Last): 14 December 2006
Pages: 303
PDF File Size: 8.21 Mb
ePub File Size: 16.12 Mb
ISBN: 913-6-56680-180-8
Downloads: 2356
Price: Free* [*Free Regsitration Required]
Uploader: Zujin

This indicates the source machine and TCP port on that machine from which this data is coming.

This item is visible if you press M for more TCP information. Instances and Logging Starting with version 2. See the Logging section below for detailed information on logging. Over time, the entries will go out of order as counts proceed at varying rates. Your system’s network interfaces must be mnual according to the schemes specified above. While reverse lookup is being conducted in the background, IP addresses will be used until the resolution is complete.

The destination is the host: On masquerading machines, packets and connections from the internal network to the external network also appear twice, one for the internal and external interface.

UDP packets are also displayed lptraf address: However, screen updates are one of the slowest operations iphraf program performs. This does not determine how long it remains onscreen. Packet Size The size of the most recently received packet. This bracket appears at the leftmost part of each entry.


However, if these get too many, active connections may become interspersed among closed, reset, or idle entries. To make it easier to determine the direction pairs of each connection, a bracket is used to “join” both together.

In other words, the figures indicated do not reflect the counts since the start of the TCP connection, but rather, since the start of the traffic monitor. The M iptarf displays more TCP information.

iptraf(8): Interactive Colorful IP LAN Monitor – Linux man page

To minimize these entries, an entry is not added by the monitor until a packet with data or a SYN packet is received.

For all packets in the lower window, only the first IP fragment is indicated since that contains the header of the IP-encapsulated protocol but with no further information from the encapsulated protocol. In other words, it does not determine which endpoint is the client, and which is the server.

You can also press the F key to arbitrarily clear it at any time. If only an S is present S the source is trying to initiate a connection. This is because the traffic monitor cannot determine if a connection was already half-closed when it started. You can override the defaults with the -L parameter.

This is the size of the IP datagram only, not including the data link header. The Traffic Monitor is a real-time monitoring system that intercepts all packets on all detected network interfaces. This is an acknowledgment of a previously received packet P PSH.


Each entry in the window contains these fields: A synchronization is taking place in preparation for connection establishment.

In addition to that, it also determines the encapsulated protocol within the IP packet, and displays some important information about that as well. Direction entries also become available for reuse if an ICMP Destination Unreachable message is received for the connection.

DONE The connection is done sending data in this direction, and has sent a FIN finished packet, but has not yet been acknowledged by the other iptrzf.

Data link header e.

IPTraf User’s Manual

The sort operation compares the larger values in each connection entry pair and sorts the counts in descending order. This means the connection was already iprtaf when the monitor started. You may accept this default or change it. Therefore, eth0 refers to the first Ethernet interface, eth1 to the second, and so on.

IPTraf User’s Manual

This figure can be changed at the Configure menu. Lower Window The lower window displays information about the other types of traffic on your network. A request to push all data to the top of the receiving queue U URG. Cancelling will turn logging off for that particular session.