[Iftop-users] howdy

[Paul Warren]

On Sat, Nov 01, 2003 at 07:25:27PM +0200, raptor wrote:
> Thanx alot for this super program... it is very helpfull for analyzing my network...:")
> I was wondering would it be harder a  output to a file be implemented, more specificly it would be
> good if I can capture the total speed and/or total/MB transffered every X seconds.
> So that If I can say something like this :

It's something I've considered, but I would have thought that this would
be a better fit for tcpdump's mode of operation.  That said, it'd be
pretty easy to implement, so I'll bung it on the TODO list.

> One other idea was to be able to group the output of iftop based on some criteria say class C networks,
> I mean instead of seeing every host of the network, see their combined graph...
> So if I have 5 class C networks I can view their performance... and/or if many users access some outside 
> class C network i can view total speed used to access these severs .. So it has to be source and/or dest based.
> or auto sensing when I exclude source "s" group on dest addresses,  and vs. versa ("d").

An interesting idea - this basically amounts to putting a netmask on all
hosts.

> Output based on class C networks would be very good too... this way with a single run I can make comparison
> of several source or destination nets...
> net|time|Bytes|speed-kbit/s
> 192.168.0.0/24|0|1000|30
> 10.10.0.0/24|0|1000|30
> 192.168.0.0/24|10|3000|37
> 10.10.0.0/24|10|3000|37

How would this be arranged?  iftop currently works on host-pairs.
Would you list traffic by net-pairs, or by total traffic into/out of a
network.  This would probably be the best option, but would mean that
all traffic would be accounted twice as traffic leaving one network (or
host) is entering another.

> Third idea : make time periods for averaging the 3 speed columns configurable... 

That's come up before (I think it's on the TODO list).  Given the way
the code is written, it'd actually be a bit painful to implement, and
I'm not sure that there's that much to be gained.  I take my lead from
load averages - 1min, 5min and 10min are the accepted averages for load
and unconfigurable.

That's not to say I wouldn't accept a patch, of course.

Paul