Hi all,
I am the current maintainer of iftop for Debian GNU/Linux. In the past months and years users reported various bugs and feature requests for iftop and since I don't see that someone forwarded them upstream, I have made a short compilation of those outstanding issues. Feedback is much appreciated.
1. iftop does not notice changes to ppp interfaces and stops refreshing its output http://bugs.debian.org/543138
Iftop does not recognize changes to interfaces. If the interface goes temporarily down and then up again, iftop is not capable of recognizing the change and cannot display the traffic anymore. A manual restart is required to make it work again. It would be nice if iftop could detect such a change and continue with monitoring.
2. iftop: chooses eth0 as the default interface instead of the default route http://bugs.debian.org/644998
If the -i option is not specified, iftop looks for the first interface which is up and falls back to eth0 if none are found. On systems where two interfaces such as eth0 and wlan0 are up and the default route points to wlan0, iftop still chooses eth0 by default.
The code could be changed in two ways: * Only consider interfaces with routes associated with them. * Prefer the interface with a default route to other ones.
3. Add a command-line option to specify the Display Mode http://bugs.debian.org/511174
"Currently, the display mode can be toggled between "One line per host", "Received traffic only", "Sent traffic only" and "Two lines per host":
- either by pressing the "t" key, - or by setting the "line-display" parameter in the config file.
It would be very useful to have a way to specify this through a command-line option, like it's currently possible with most other frequently-used iftop adjustments."
4. Add a "min-bandwidth" option, so less resolution is wasted on logarithmic scale. http://bugs.debian.org/520386
"A "min-bandwidth" option analogous to the "max-bandwidth" option should be added. Currently the logarithmic display wastes a lot of space in the 0 - few-kilobytes-per-second range, which is often not useful (unless you're trying to examine intrusion attempts or something like that), causing the interesting range up to the maximum bandwidth to be crammed into just the right half of the screen. Being able to specify the minimum bandwidth to display would help a lot."
5. NAT support http://bugs.debian.org/631682
One user asked for NAT support for using iftop on a router to monitor traffic.
6. bar graph average should be an option in iftoprc http://bugs.debian.org/704813
The option "bar graph average (-B)" can be used within iftop but there is no corresponding option in iftoprc.
Thanks for reading
Regards,
Markus
Markus,
Thanks for passing this on. These all sound like reasonable suggestions, which I'll consider when next working on iftop.
There's a couple where I'd be grateful for pointers from anyone on the list about how to implement (even more grateful for patches!)
On 13/11/2013 11:05, Markus Koschany wrote:
- iftop does not notice changes to ppp interfaces and stops refreshing its output http://bugs.debian.org/543138
Does anyone know how to detect when this happens? It's obviously not treated as an error by pcap_loop() when it happens.
- iftop: chooses eth0 as the default interface instead of the default route http://bugs.debian.org/644998
The code could be changed in two ways:
- Only consider interfaces with routes associated with them.
- Prefer the interface with a default route to other ones.
This is a great idea, but what's the easiest way to identify these interfaces programmatically?
- NAT support http://bugs.debian.org/631682
One user asked for NAT support for using iftop on a router to monitor traffic.
Is this feasible? I'm not sure how I'd go about trying to un-NAT a packet for display.
Paul
On Mon, Nov 18, 2013 at 04:03:39PM +0000, Paul Warren wrote:
- NAT support http://bugs.debian.org/631682
One user asked for NAT support for using iftop on a router to monitor traffic.
Is this feasible? I'm not sure how I'd go about trying to un-NAT a packet for display.
My guess is looking for conntrack.
On Mon, 18. Nov 16:03 Paul Warren pdw@ex-parrot.com wrote: [...]
On 13/11/2013 11:05, Markus Koschany wrote:
- iftop does not notice changes to ppp interfaces and stops refreshing its output http://bugs.debian.org/543138
Does anyone know how to detect when this happens? It's obviously not treated as an error by pcap_loop() when it happens.
Unfortunately no. Perhaps there are some hints in ifconfig's source code. I could also imagine some buffer that stores the amount of captured packages. If the amount equals zero in a given time frame, one may assume that the device is down and a restart of iftop's capture process necessary. This could be a special option or mode, so that people have to choose it explicitly.
- iftop: chooses eth0 as the default interface instead of the default route http://bugs.debian.org/644998
The code could be changed in two ways:
- Only consider interfaces with routes associated with them.
- Prefer the interface with a default route to other ones.
This is a great idea, but what's the easiest way to identify these interfaces programmatically?
Perhaps you could use a command like
ip route show 0.0.0.0/0
The last output argument is the device with the default route associated to it.
An alternative might be to display all available interfaces at startup and let the user choose the interface herself. (only a small improvement over the -i option but this should definitely work)
Regards,
Markus
On Mon, 18. Nov 16:03 Paul Warren pdw@ex-parrot.com wrote:
Markus,
Thanks for passing this on. These all sound like reasonable suggestions, which I'll consider when next working on iftop.
I forgot to mention another feature request, a top-list based on port numbers.
I know that there is the p key to toggle port numbers but it would be nice if iftop could also show the total traffic statistics per port, so that it becomes easily visible what local port causes the most traffic. I believe iptraf has implemented a similar feature.
Markus
On 19/11/2013 10:22, Markus Koschany wrote:
On Mon, 18. Nov 16:03 Paul Warren pdw@ex-parrot.com wrote:
Markus,
Thanks for passing this on. These all sound like reasonable suggestions, which I'll consider when next working on iftop.
I forgot to mention another feature request, a top-list based on port numbers.
I know that there is the p key to toggle port numbers but it would be nice if iftop could also show the total traffic statistics per port, so that it becomes easily visible what local port causes the most traffic. I believe iptraf has implemented a similar feature.
Press s, d, S.
s = hide source host d = hide dest host S = show dest port
This will give you traffic grouped according to local port.
Paul
On Tue, 19. Nov 10:29 Paul Warren pdw@ex-parrot.com wrote:
Press s, d, S.
s = hide source host d = hide dest host S = show dest port
This will give you traffic grouped according to local port.
Thank you. Indeed I think that's it.
Markus
On 19/11/2013 10:39, Markus Koschany wrote:
On Tue, 19. Nov 10:29 Paul Warren pdw@ex-parrot.com wrote:
Press s, d, S.
s = hide source host d = hide dest host S = show dest port
This will give you traffic grouped according to local port.
Thank you. Indeed I think that's it.
Although I've just noticed that it doesn't group IPv6 and IPv4 traffic into the same pot, so you can get two entries for each port on a dual-stack system.
If you could tell which was which, you might call this a feature.
Paul
-
Markus Koschany -
Michael Shigorin -
Paul Warren