traffic-vis(8)

NAME
traffic-vis - Collect and report on network traffic

SYNOPSIS
traffic-vis [-pdREWTCVh] [-i, --interface interface] [-f, --filter bpf-filter] [-n, --num-hosts num] [-N, --num-peers num] [-r, --read-file tcpdump-file] [-H, --host-sort sort-key] [-P, --peer-sort sort-key] [-t, --time minutes]

DESCRIPTION
traffic-vis is a network traffic monitoring and analysis tool. When executed traffic-vis will place the specified interface in promiscuous mode (unless told otherwise) and begin collecting packets. When traffic-vis is interrupted with a SIGTERM, SIGINTR or SIGHUP with will write a report in the format of your choice to the standard output.

The report lists traffic per host, total network traffic and which hosts communicated and with whom. The report can be sorted in several different ways, as can the per-host list of peers. ASCII, HTML and Postscript format reports are currently supported.

traffic-vis can also accept tcpdump style packet filter descriptions and read packet dump files generated by tcpdump

OPTIONS

-p, --no-promisc
    Do not put the interface into promiscuous mode.

-d, --no-dns
    Do not attempt to resolve hostnames.

-i, --interface interface
    Use interface instead of default.

-f, --filter filter
    Use bpf / tcpdump filter to screen packets.

-n, --num-hosts num
    Limit number of hosts to display

-N, --num-peers num
    Limit number of peers to display per host

-r, --read-file file
    Read a tcpdump packet trace file instead of listening on a live interface

-H, --host-sort sort-key
    Sort hosts by sort-key (see SORTING section for details).

-P, --peer-sort sort-key
    Sort peer lists by sort-key (see SORTING section for details).

-R, --reverse-hosts
    Reverse host list sort order

-E, --reverse-peer
    Reverse peer lists sort order

-W, --html
    Produce HTML formatted output

-T, --text
    Produce ASCII formatted output

-C, --postscript
    Produce Postscript format output. NB. you will probably want to limit the number of hosts to display - I find a number around 50 is not too cluttered.

-t, --time minutes
    Specify maximum time to collect packets for.

-V, --version
    Display version information and exit

-h, --help
    Display version information and exit

SORTING
The host and peer lists can be sorted in one of several ways with the -H and -P options. While several sort keys can be used for both hosts and peers, some cannot. The following table documents the function of each sort key and the context in which it is valid: N, none Do not sort (hosts + peers).

b, bytes
    Total bytes send and received (hosts + peers).

s, bsent
    Bytes sent (hosts).

r, breceived
    Bytes received (hosts + peers).

p, packets
    Total packets sent and received (hosts + peers).

S, psent
    Packets sent (hosts).

R, preceived
    Packets received (hosts).

C, connects
    Total TCP connection requests sent and received (hosts + peers).

c, csent
    TCP connection requests sent (hosts).

l, creceived
    TCP connections requests received (hosts).

P, peers
    Number of peers (hosts).

h, hostname
    Hostname (hosts).

I, ipaddr
    IP address (hosts).

F, firstseen
    Time of first detected traffic (hosts + peers).

L, lastseen
    Time of last recorded traffic (hosts + peers).

X, random
    Random (hosts + peers).

EXAMPLES
The simplest example:

    traffic-vis

Will listen on the first available interface, sort hosts and peers by total bytes sent and received and report in ASCII format.

This example limits the number of hosts to 50, sorting them by reverse bytes sent (i.e the 50 quietest hosts on the network).

    traffic-vis -n 50 -H s

This example uses a BPF packet filter to ignore all traffic except SMTP and generates a HTML report after 15 minutes:

    traffic-vis -f "tcp port 25" -t 15 -W

Every option has a corresponding long option, this can make commandlines much more readable:

    traffic-vis --filter "tcp port 80" --postscript

SEE ALSO
tcpdump(8), bpf(4), pcap(3)

AUTHORS
Damien Miller <dmiller@ilogic.com.au>

http://www.ilogic.com.au/~dmiller/traffic-vis.html

BUGS
Hopefully none, probably legion.