FLOWTOP - Online Linux Manual PageSection : 8
Updated : 03 March 2013
Source : Linux
Note : netsniff-ng toolkit
NAMEflowtop − top-like netfilter TCP/UDP/SCTP/DCCP/ICMP(v6) flow tracking
SYNOPSISflowtop { [options] }
DESCRIPTIONflowtop is a top-like connection tracking tool that can run on an end host or small home router. It is able to present TCP, UDP/UDP-lite, SCTP, DCCP, and ICMP(v6) flows that have been collected by the kernel's netfilter connection tracking framework, thus no packet capturing in user space needs to be done. flowtop is able to give you a quick overview of current connections on your local system, e.g. for debugging purposes or to answer questions like:
* If you access website X, what other connections are being opened in
the background that I'm not aware of?
* What connections are active that pass one's router?
* I have this proprietary binary Y, to where does it connect?
* To which countries am I sending data?
* Are there any suspicious background connections on my machine?
* How many active connections does binary Y have?
* How long are connections active already?
* At which rate am I sending/receiving data? The following information will be presented in flowtop's output:
* Application name and PID when run on local machine
* Reverse DNS for source and destination
* Geo-location information (country, city)
* Used protocols (IPv4, IPv6, TCP, UDP, SCTP, ICMP, ...)
* Flow port's service name heuristic
* Transport protocol state machine information
* Byte/packet counters (if they are enabled)
* Connection duration (if timestamping is enabled)
* Flow send/receive rate (if byte/packet counters are enabled) In order for flowtop to work, netfilter must be active and running on your machine, thus kernel-side connection tracking is active. If netfilter is not running, you can activate it with iptables(8): iptables -A INPUT -p tcp -m state --state ESTABLISHED -j ACCEPT iptables -A OUTPUT -p tcp -m state --state NEW,ESTABLISHED -j ACCEPT or by loading the following kernel modules: modprobe nf_conntrack_ipv4 modprobe nf_conntrack_ipv6 To dump byte/packet counters flowtop enables the sysctl(8) parameter net.netfilter.nf_conntrack_acct via: echo 1 > /proc/sys/net/netfilter/nf_conntrack_acct and resets it to the previously set value on exit. These counters will only be active on connections which were created after accounting was enabled. Thus, to have these counters be active all the time the parameter should be enabled after the system is up. To automatically enable it, sysctl.conf(8) or sysctl.d(8) might be used. To calculate the connection duration flowtop enables the sysctl(8) parameter net.netfilter.nf_conntrack_timestamp via: echo 1 > /proc/sys/net/netfilter/nf_conntrack_timestamp and resets it to the previously set value on exit. flowtop's intention is just to get a quick look over your active connections. If you want logging support, have a look at netfilter's conntrack(8) tools instead.
OPTIONS-4, --ipv4 Display IPv4 flows. That is the default when flowtop is started without any arguments. -6, --ipv6 Display IPv6 flows. That is the default when flowtop is started without any arguments. -T, --tcp Display TCP flows. That is the default when flowtop is started without any arguments. -U, --udp Display UDP and UDP-lite flows. -D, --dccp Display DCCP flows. -I, --icmp Display ICMP version 4 and version 6 flows. -S, --sctp Display SCTP flows. -n, --no-dns Don't perform hostname lookup. Only numeric addresses will be shown for flow endpoints. -G, --no-geoip Don't perform GeoIP lookup. No geographical information will be shown for flow endpoints. -s, --show-src Also show source information of the flow, not only destination information. -b, --bits Show flow rates in bits per second instead of bytes per second. -u, --update The built-in database update mechanism will be invoked to get Maxmind's latest database. To configure search locations for databases, the file /etc/netsniff-ng/geoip.conf contains possible addresses. Thus, to save bandwidth or for mirroring Maxmind's databases (to bypass their traffic limit policy), different hosts or IP addresses can be placed into geoip.conf, separated by a newline. -t <time>, --interval <time> Flow info refresh interval in seconds, default is 1s. -v, --version Show version information and exit. -h, --help Show user help and exit.
USAGE EXAMPLEflowtop Default ncurses output for flowtop that tracks IPv4, IPv6 flows for TCP. flowtop -46UTDISs This example enables the maximum display options for flowtop.
CONFIG FILESFiles under /etc/netsniff-ng/ can be modified to extend flowtop's service resolution and lookup information.
* tcp.conf - TCP port/services map
* udp.conf - UDP port/services map
* geoip.conf - GeoIP database mirrors
BUGSWith a fairly high rate of connection tracking updates, flowtop can become unresponsive for short periods of time while scrolling. The right fix would be to replace flowtop's connection management backend with a better design with respect to the locking approach. This is still on the "todo" list.
LEGALflowtop is licensed under the GNU GPL version 2.0.
HISTORYflowtop was originally written for the netsniff-ng toolkit by Daniel Borkmann. It is currently maintained by Tobias Klauser <tklauser@distanz.ch> and Daniel Borkmann <dborkma@tik.ee.ethz.ch>.
SEE ALSOnetsniff-ng(8), trafgen(8), mausezahn(8), ifpps(8), bpfc(8), astraceroute(8), curvetun(8), iptables(8), sysctl(8), sysctl.conf(8), sysctl.d(8)
AUTHORManpage was written by Daniel Borkmann.
COLOPHONThis page is part of the Linux netsniff-ng toolkit project. A description of the project, and information about reporting bugs, can be found at http://netsniff-ng.org/. 0
Johanes Gumabo
Data Size : 19,732 byte
man-flowtop.8Build : 2024-12-05, 20:55 :
Visitor Screen : x
Visitor Counter ( page / site ) : 4 / 165,941
Visitor ID : :
Visitor IP : 3.22.27.41 :
Visitor Provider : AMAZON-02 :
Provider Position ( lat x lon ) : 39.962500 x -83.006100 : x
Provider Accuracy Radius ( km ) : 1000 :
Provider City : Columbus :
Provider Province : Ohio , : ,
Provider Country : United States :
Provider Continent : North America :
Visitor Recorder : Version :
Visitor Recorder : Library :
Online Linux Manual Page : Version : Online Linux Manual Page - Fedora.40 - march=x86-64 - mtune=generic - 24.12.05
Online Linux Manual Page : Library : lib_c - 24.10.03 - march=x86-64 - mtune=generic - Fedora.40
Online Linux Manual Page : Library : lib_m - 24.10.03 - march=x86-64 - mtune=generic - Fedora.40
Data Base : Version : Online Linux Manual Page Database - 24.04.13 - march=x86-64 - mtune=generic - fedora-38
Data Base : Library : lib_c - 23.02.07 - march=x86-64 - mtune=generic - fedora.36
Very long time ago, I have the best tutor, Wenzel Svojanovsky . If someone knows the email address of Wenzel Svojanovsky , please send an email to johanes_gumabo@yahoo.co.id .
If error, please print screen and send to johanes_gumabo@yahoo.co.id
Under development. Support me via PayPal.