On Mon, 15 Jan 2007 15:13:56 +0200 "Martins Dzelde" martins.dzelde@latrude.lv wrote:

I can only say that the list is not very responsive to questions. The only negotiation that sometimes goes throught are some updates, written patches, or bug posts.

The list is alive, but has low traffic.

For example, I was trying to find how to see traffic per host on my subnet. I couldnt find the info even in manual, nor googling. No one replied thought the answer was pretty simple: you have to run iftop on desired subnet, ie. 'iftop -F 192.168.0.0/24' and the press 'd' to hide destination address. Then it nicely shows total traffic for every ip address on the subnet.

iftop -f 'host 192.168.0.1'

The -f option accepts AFAIK tcpdump filter syntax:

iftop -f 'host 192.168.64.103 or host 192.168.64.2'

HTH,

R.

Hello!

There are a number of us still passively listening, though.

and me being one of them. :)

Thanks a lot for the replies. Well, i am using iftop version 0.17 on freebsd 6.1, installed through ports. i think it should be the latest, although havent been doing updates for few months, there might be few patches to apply. the freebsd box is running as a bridge with two NICs. Only one nic has an IP address.

another observation is that the speeds for the traffic slowly decreases although i am sure that everything is still runnings. my guess is that the total traffic somhow sums up and is dived by the current traffic, hence the speed decreases. so it gives a more or less precise measure only for a few minutes. just did this test once more: i run the command: 'iftop -F 192.168.0.0/24' and press d to hide the destination address and after few minutes CPU if down from 73% idle to 10% idle.

Martins.

On Mon, 15 Jan 2007 15:41:24 +0200, Jonathan Abbey jonabbey@arlut.utexas.edu wrote:

On Mon, Jan 15, 2007 at 03:13:56PM +0200, Martins Dzelde wrote: | Hi, pat! | | I can only say that the list is not very responsive to questions. The only | negotiation that sometimes goes throught are some updates, written | patches, or bug posts.

| For example, I was trying to find how to see traffic per host on my | subnet. I couldnt find the info even in manual, nor googling. No one | replied thought the answer was pretty simple: you have to run iftop on | desired subnet, ie. 'iftop -F 192.168.0.0/24' and the press 'd' to hide | destination address. Then it nicely shows total traffic for every ip | address on the subnet. | | Although I havent yet found how to work around the problem that the | traffic agreggates, ie, sums up and fills up all the memory for the | computer. May be someone knows a hint?

I haven't seen this. What operating system type and version are you running iftop on?

I assume you're running the very latest iftop from pdw?

Jon

| Good luck, | Martins.

On Mon, 15 Jan 2007 17:18:41 +0200, Paul Warren pdw@ex-parrot.com wrote:

On Mon, Jan 15, 2007 at 07:41:24AM -0600, Jonathan Abbey wrote:

...

| Although I havent yet found how to work around the problem that the | traffic agreggates, ie, sums up and fills up all the memory for the | computer. May be someone knows a hint?

I haven't seen this. What operating system type and version are you running iftop on?

I assume you're running the very latest iftop from pdw?

It sounds vaguely familiar from the past...

Do you have a very large number of hosts on the network? It should forget about hosts once they fall out of the 60 second(?) window that it watches.

I was posting questions long,long time ago. About 'very large' - dont know - I have around 200 hosts on my network on a 32Mbit link, thats something but not very large. It would be good if iftop would forget about each connection after a time ( it could only keep the total traffic processed per host, that shouldnt take up too much memory). The problem seems to be that iftop saves all the connections (all hosts on all ports) proccessed and that surely summs up quickly. Should iftop drop the old traffic? btw, the freebsd box should be powerfull enough (P4, 1 Gb ram).

And the features saving a statistics offered by pat would be very good. The next thing would be a possibility to leave iftop running as a deamon, generating logs, logs for MRTG, etc. that would be great. But anyway, it is very usefull as it is.

Martins.