Hello all,
I have to sniff internet traffic (igress and egress) but regardless of the display options I can set, for example only entry or exit traffic, with the -t option
I always get only one ouput with both directions.
Example I want to capure incoming traffic.
in the conf file I set line-display: one-line-received
/usr/sbin/iftop-new -c /root/.iftopigress -L 300
I obtain all incoming traffic
The same thing that I obtain launching iftop followed by double t and 3 options:
19.19.19.19:22267 <= 23.50.100.254:https 19.1kb 9.54kb 9.54kb
19.19.19.15:15831 <= 169.50.27.202:https 17.3kb 8.66kb 8.66kb
19.19.19.12:https <= 89.96.192.28:40576 0b 8.52kb 8.52kb
When I add on the prompt command line -t option the text output is different:
iftop-new -i eth0 -n -P -o 40s -L 300 -t -s 10
1 19.19.19.19:25653 => 146Kb 158Kb 158Kb 197KB
8.248.205.254:http <= 7.80Mb 8.40Mb 8.40Mb 10.5MB
2 19.19.19.19:https => 8.83Mb 2.01Mb 2.01Mb 2.51MB
93.57.248.155:58651 <= 132Kb 32.5Kb 32.5Kb 40.7KB
The second problem is that the -s option for the timeout is only associated to the text mode only.
I must work with ulimit -tm timeout or alarm parameter on perl script. I would like something included in the iftop program.
The third problem is that if I do not use text mode (without t option) I obtain ncurses output that I can open with cat.
Mey you suggest me a Linux tool to convert ncurses file to ascii ?
Thank you guys.
Regards
Nellox
