NAME¶
tcptrack - Monitor TCP connections on the network
SYNOPSIS¶
tcptrack [
-dfhvp ] [
-r seconds ]
-i
interface
[
filter expression ]
DESCRIPTION¶
tcptrack displays the status of TCP connections that it sees on a given network
interface. tcptrack monitors their state and displays information such as
state, source/destination addresses and bandwidth usage in a sorted, updated
list very much like the
top(1) command.
The filter expression is a standard pcap filter expression (identical to the
expressions used by
tcpdump(8)) which can be used to filter down the
characteristics of TCP connections that tcptrack will see. See
tcpdump(8) for
more information about the syntax of this expression.
OPTIONS¶
- -d
- Only track connections that were started after tcptrack was
started. Do not try to detect existing connections.
- -f
- Enable fast average recalculation. TCPTrack will calculate
the average speeds of connections by using a running average. TCPTrack
will use more memory and CPU time, but averages will seem closer to real
time and will be updated more than once per second and may be more
accurate under heavy load. The number of times per second that averages
will be recalculated in fast mode is a compile-time setting that defaults
to 10 times per second.
- -h
- Display command line help
- -i [interface]
- Sniff packets from the specified network interface.
- -T [pcap file]
- Read packets from the specified file instead of sniffing
from the network. Useful for testing.
- -p
- Do not put the interface being sniffed into promiscuous
mode.
- -r [seconds]
- Wait this many seconds before removing a closed connection
from the display. Defaults to 2 seconds. See also the pause interactive
command (below).
- -v
- Display tcptrack version
INTERACTIVE COMMANDS¶
The following keys may be pressed while tcptrack is running to change runtime
options:
p - Pause/unpause display. No new connections will be added to the
display, and all currently displayed connections will remain in the display.
q - Quit tcptrack.
s - Cycle through the sorting options: unsorted, sorted by rate, sorted
by total bytes.
The options for pausing and toggling sorting are useful if you're watching a
very busy network and want to look at the display without connections jumping
around (due to sorting and new connections being added) and disappearing (due
to being closed for a certain time).
When paused (via the p command) no new connections will be displayed, however
tcptrack will still monitor and track all connections it sees as usual. This
option affects the display only, not internals. When you unpause, the display
will be updated with all current information that tcptrack has been gathering
all along.
EXAMPLES¶
tcptrack requires only one parameter to run: the -i flag followed by an
interface name that you want tcptrack to monitor. This is the most basic way
to run tcptrack:
# tcptrack -i eth0
tcptrack can also take a pcap filter expression as an argument. The format of
this filter expression is the same as that of
tcpdump(8) and other
libpcap-based sniffers. The following example will only show connections from
host 10.45.165.2:
# tcptrack -i eth0 src or dst 10.45.165.2
The next example will only show web traffic (ie, traffic on port 80):
# tcptrack -i eth0 port 80
SEE ALSO¶
tcpdump(8),
pcap(3),
http://www.rhythm.cx/~steve/devel/tcptrack
BUGS¶
When picking up a connection that was already running before tcptrack was
started, there is no way tcptrack can know for sure which end of the
connection is the client (ie, which peer started the connection) and which is
the server (ie, which peer was listening). tcptrack makes a crude guess at
which is which by looking at the port numbers; whichever end has the lower
port number is considered the server side. This isn't always accurate of
course, but future versions may have better heuristics to figure out which end
is which.
Currently the interface is not very flexible. Display timing settings (such as
the refresh interval) can only be changed by editing the source code (defs.h
in particular). See the TODO file included with the source distribution for
further bugs.