From grdngable at gmail.com  Thu Oct 14 23:20:09 2010
From: grdngable at gmail.com (Gordon Gable)
Date: Thu, 14 Oct 2010 23:20:09 +0100
Subject: [Iftop-users] find upload hogs
Message-ID: <AANLkTikc0bpA5R7UEtB41T7QHnUAKvCtVsMzkvv7dXeA@mail.gmail.com>

--001517576cdcee2d1904929b1c5a
Content-Type: text/plain; charset=ISO-8859-1

i help running a small wireless mesh. altough our p2pfilters at gateway
nodes are fairly acurate, we sometimes find people resorting to all kinds of
tricks to circumvent those.

to ease pinpointing villains, is there a way in iptraf to sort ip address by
*upload* only?

/gordon

--001517576cdcee2d1904929b1c5a
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

<meta http-equiv=3D"content-type" content=3D"text/html; charset=3Dutf-8"><s=
pan class=3D"Apple-style-span" style=3D"font-family: arial, sans-serif; fon=
t-size: 13px; border-collapse: collapse; "><div>i help running a small wire=
less mesh. altough our p2pfilters at gateway nodes are fairly acurate, we s=
ometimes find people resorting to all kinds of tricks to circumvent those.<=
/div>
<div><br></div><div>to ease pinpointing villains, is there a way in iptraf =
to sort ip address by *upload* only?</div><div><br></div><font color=3D"#88=
8888"><div>/gordon</div></font></span>

--001517576cdcee2d1904929b1c5a--


From grdngable at gmail.com  Fri Oct 15 00:24:22 2010
From: grdngable at gmail.com (Gordon Gable)
Date: Fri, 15 Oct 2010 00:24:22 +0100
Subject: [Iftop-users] Re: find upload hogs
In-Reply-To: <AANLkTikc0bpA5R7UEtB41T7QHnUAKvCtVsMzkvv7dXeA@mail.gmail.com>
References: <AANLkTikc0bpA5R7UEtB41T7QHnUAKvCtVsMzkvv7dXeA@mail.gmail.com>
Message-ID: <AANLkTin2r72BRBvas4Kh4EdRBKAMZ_5iBrNc0--75qmU@mail.gmail.com>

--20cf301d3e7c96e6f904929c02a6
Content-Type: text/plain; charset=ISO-8859-1

iftop, i mean. sorry.

2010/10/14 Gordon Gable <grdngable@gmail.com>

> i help running a small wireless mesh. altough our p2pfilters at gateway
> nodes are fairly acurate, we sometimes find people resorting to all kinds of
> tricks to circumvent those.
>
> to ease pinpointing villains, is there a way in iptraf to sort ip address
> by *upload* only?
>
> /gordon
>

--20cf301d3e7c96e6f904929c02a6
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

iftop, i mean. sorry.<br><br><div class=3D"gmail_quote">2010/10/14 Gordon G=
able <span dir=3D"ltr">&lt;<a href=3D"mailto:grdngable@gmail.com">grdngable=
@gmail.com</a>&gt;</span><br><blockquote class=3D"gmail_quote" style=3D"mar=
gin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
<div><div></div><div class=3D"h5"><span style=3D"font-family:arial, sans-se=
rif;font-size:13px;border-collapse:collapse"><div>i help running a small wi=
reless mesh. altough our p2pfilters at gateway nodes are fairly acurate, we=
 sometimes find people resorting to all kinds of tricks to circumvent those=
.</div>

<div><br></div><div>to ease pinpointing villains, is there a way in iptraf =
to sort ip address by *upload* only?</div><div><br></div><font color=3D"#88=
8888"><div>/gordon</div></font></span>
</div></div></blockquote></div><br>

--20cf301d3e7c96e6f904929c02a6--


From jlay at slave-tothe-box.net  Fri Oct 15 00:23:08 2010
From: jlay at slave-tothe-box.net (James Lay)
Date: Thu, 14 Oct 2010 17:23:08 -0600
Subject: [Iftop-users] find upload hogs
In-Reply-To: <AANLkTikc0bpA5R7UEtB41T7QHnUAKvCtVsMzkvv7dXeA@mail.gmail.com>
Message-ID: <C8DCECD8.1310%jlay@slave-tothe-box.net>

> This message is in MIME format. Since your mail reader does not understand
this format, some or all of this message may not be legible.

--B_3369921797_343930
Content-type: text/plain;
	charset="US-ASCII"
Content-transfer-encoding: 7bit

From:  Gordon Gable <grdngable@gmail.com>
Date:  Thu, 14 Oct 2010 23:20:09 +0100
To:  <iftop-users@lists.beasts.org>
Subject:  [Iftop-users] find upload hogs

i help running a small wireless mesh. altough our p2pfilters at gateway
nodes are fairly acurate, we sometimes find people resorting to all kinds of
tricks to circumvent those.

to ease pinpointing villains, is there a way in iptraf to sort ip address by
*upload* only?

/gordon

Run it, then hit t until you toggle to Sent Traffic Only.

James



--B_3369921797_343930
Content-type: text/html;
	charset="US-ASCII"
Content-transfer-encoding: quoted-printable

<html><head><meta http-equiv=3D"content-type" content=3D"text/html; charset=3Dutf=
-8"></head><body style=3D"word-wrap: break-word; -webkit-nbsp-mode: space; -we=
bkit-line-break: after-white-space; color: rgb(0, 0, 0); font-size: 14px; fo=
nt-family: Calibri, sans-serif; "><div><span class=3D"Apple-style-span" style=3D=
"font-family: Calibri; font-size: 15px; "><span style=3D"font-weight:bold">Fro=
m: </span> Gordon Gable &lt;<a href=3D"mailto:grdngable@gmail.com">grdngable@g=
mail.com</a>&gt;</span></div><span id=3D"OLK_SRC_BODY_SECTION"><div style=3D"fon=
t-family:Calibri; font-size:11pt; text-align:left; color:black; BORDER-BOTTO=
M: medium none; BORDER-LEFT: medium none; PADDING-BOTTOM: 0in; PADDING-LEFT:=
 0in; PADDING-RIGHT: 0in; BORDER-TOP: #b5c4df 1pt solid; BORDER-RIGHT: mediu=
m none; PADDING-TOP: 3pt"><span style=3D"font-weight:bold">Date: </span> Thu, =
14 Oct 2010 23:20:09 +0100<br><span style=3D"font-weight:bold">To: </span> &lt=
;<a href=3D"mailto:iftop-users@lists.beasts.org">iftop-users@lists.beasts.org<=
/a>&gt;<br><span style=3D"font-weight:bold">Subject: </span> [Iftop-users] fin=
d upload hogs<br></div><div><br></div><span class=3D"Apple-style-span" style=3D"=
font-size: 13px; border-collapse: collapse; font-family: arial, sans-serif; =
"><div>i help running a small wireless mesh. altough our p2pfilters at gatew=
ay nodes are fairly acurate, we sometimes find people resorting to all kinds=
 of tricks to circumvent those.</div><div><br></div><div>to ease pinpointing=
 villains, is there a way in iptraf to sort ip address by *upload* only?</di=
v><div><br></div><font color=3D"#888888"><div>/gordon</div></font></span></spa=
n><div><br></div><div>Run it, then hit t until you toggle to Sent Traffic On=
ly.</div><div><br></div><div>James</div></body></html>

--B_3369921797_343930--




From pdw at ex-parrot.com  Fri Oct 15 00:31:38 2010
From: pdw at ex-parrot.com (Paul Warren)
Date: Fri, 15 Oct 2010 00:31:38 +0100
Subject: [Iftop-users] Re: find upload hogs
In-Reply-To: <AANLkTin2r72BRBvas4Kh4EdRBKAMZ_5iBrNc0--75qmU@mail.gmail.com>
References: <AANLkTikc0bpA5R7UEtB41T7QHnUAKvCtVsMzkvv7dXeA@mail.gmail.com> <AANLkTin2r72BRBvas4Kh4EdRBKAMZ_5iBrNc0--75qmU@mail.gmail.com>
Message-ID: <4CB792DA.7010804@ex-parrot.com>

On 15/10/2010 00:24, Gordon Gable wrote:
 > iftop, i mean. sorry.
 >
 > 2010/10/14 Gordon Gable <grdngable@gmail.com 
<mailto:grdngable@gmail.com>>
 >
 >     i help running a small wireless mesh. altough our p2pfilters at
 >     gateway nodes are fairly acurate, we sometimes find people resorting
 >     to all kinds of tricks to circumvent those.
 >
 >     to ease pinpointing villains, is there a way in iptraf to sort ip
 >     address by *upload* only?
 >
 >     /gordon
 >
 >


No - but it's an easy enough change to make if you want to hack it.  In 
ui.c find this bit of code:

int screen_line_bandwidth_compare(host_pair_line* aa, host_pair_line* 
bb, int start_div) {
     int i;
     for(i = start_div; i < HISTORY_DIVISIONS; i++) {
         if(aa->recv[i] + aa->sent[i] != bb->recv[i] + bb->sent[i]) {
             return(aa->recv[i] + aa->sent[i] < bb->recv[i] + bb->sent[i]);
         }
     }
     return 1;
}

and delete the "recv" part of each of the sums.  I guess it would be 
nice to sort based on what's on screen, but obviously that's a bit more 
involved.

Paul




From pdw at ex-parrot.com  Fri Oct 15 09:33:13 2010
From: pdw at ex-parrot.com (Paul Warren)
Date: Fri, 15 Oct 2010 09:33:13 +0100
Subject: [Iftop-users] Re: find upload hogs
In-Reply-To: <AANLkTi=pcFaDqL2J3_oHRQjjffoRBvwyBR9-GDSbU3wS@mail.gmail.com>
References: <AANLkTikc0bpA5R7UEtB41T7QHnUAKvCtVsMzkvv7dXeA@mail.gmail.com>	<AANLkTin2r72BRBvas4Kh4EdRBKAMZ_5iBrNc0--75qmU@mail.gmail.com>	<4CB792DA.7010804@ex-parrot.com> <AANLkTi=pcFaDqL2J3_oHRQjjffoRBvwyBR9-GDSbU3wS@mail.gmail.com>
Message-ID: <4CB811C9.6020704@ex-parrot.com>

On 15/10/2010 02:31, Gordon Gable wrote:
> That does the trick, but thinking about it, if i isolate analysis on
> specific internal networks with -F, viewing sent traffic only and hiding
> destination already comes pretty close to get conclusions.
>
> about the sort order in this specific view, i notice it's not sorted by
> rate over the selected column. what is the sort order?

Even if you only have outgoing traffic only shown, it still sorts by the 
sum of incoming and outgoing, unless you hack the code as described below.

I think ideally it would sort by what you have on screen, but that 
requires a slightly more complicated change to the sort function.

Paul

> 2010/10/15 Paul Warren <pdw@ex-parrot.com <mailto:pdw@ex-parrot.com>>
>
>     On 15/10/2010 00:24, Gordon Gable wrote:
>      > iftop, i mean. sorry.
>      >
>      > 2010/10/14 Gordon Gable <grdngable@gmail.com
>     <mailto:grdngable@gmail.com> <mailto:grdngable@gmail.com
>     <mailto:grdngable@gmail.com>>>
>
>      >
>      >     i help running a small wireless mesh. altough our p2pfilters at
>      >     gateway nodes are fairly acurate, we sometimes find people
>     resorting
>      >     to all kinds of tricks to circumvent those.
>      >
>      >     to ease pinpointing villains, is there a way in iptraf to sort ip
>      >     address by *upload* only?
>      >
>      >     /gordon
>      >
>      >
>
>
>     No - but it's an easy enough change to make if you want to hack it.
>       In ui.c find this bit of code:
>
>     int screen_line_bandwidth_compare(host_pair_line* aa,
>     host_pair_line* bb, int start_div) {
>         int i;
>         for(i = start_div; i < HISTORY_DIVISIONS; i++) {
>             if(aa->recv[i] + aa->sent[i] != bb->recv[i] + bb->sent[i]) {
>                 return(aa->recv[i] + aa->sent[i] < bb->recv[i] +
>     bb->sent[i]);
>             }
>         }
>         return 1;
>     }
>
>     and delete the "recv" part of each of the sums.  I guess it would be
>     nice to sort based on what's on screen, but obviously that's a bit
>     more involved.
>
>     Paul
>
>
>
>     _______________________________________________
>     iftop-users mailing list
>     iftop-users@lists.beasts.org <mailto:iftop-users@lists.beasts.org>
>     http://lists.beasts.org/mailman/listinfo/iftop-users
>
>



From tolimar at debian.org  Fri Oct 15 12:21:40 2010
From: tolimar at debian.org (Alexander Reichle-Schmehl)
Date: Fri, 15 Oct 2010 13:21:40 +0200
Subject: [Iftop-users] iftop with IPv6 support available for testing
Message-ID: <4CB83944.1060305@debian.org>

Hi!

Thanks to the work of Mats Erik Andersson, I'm pleased to announce the
availability of IPv6 supporting iftop packages for Debian (will most
likely also work for all derivatives)!


Mats patch allowing IPv6 looks sane and fixes also some other bugs (e.g.
a segfault when using console parameters mutliple times).  His complete
patch is available at
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=427852#30 for review.

It addresses the following issues:
  * Add IPv6 support http://bugs.debian.org/427852
  * Fix segfault when using the same command line argument multiple time
    (See http://bugs.debian.org/425488)
  * Fix typo in display (see http://bugs.debian.org/477928)
  * Use better hash Algorithm in address pairs
    (http://bugs.debian.org/595169)
  * Fix link-level address detection on kfreebsd-* (see
    http://bugs.debian.org/598367)


Packages for testing are available in Debian's experimental branch
(should also work on Debian sid/squeeze) and at
http://people.debian.org/~tolimar/tmp/iftop-ipv6-backports/ (for Debian
5.0 "Lenny").


Many thanks for your work so far, Mats!


Best regards,
  Alexander


From pdw at ex-parrot.com  Fri Oct 15 14:46:08 2010
From: pdw at ex-parrot.com (Paul Warren)
Date: Fri, 15 Oct 2010 14:46:08 +0100
Subject: [Iftop-users] iftop with IPv6 support available for testing
In-Reply-To: <4CB83944.1060305@debian.org>
References: <4CB83944.1060305@debian.org>
Message-ID: <4CB85B20.6000909@ex-parrot.com>

Excellent!

Thanks to Mats for the hard work, and to Alexander for bringing these to 
the list.

I'll get these rolled into CVS.

Paul

On 15/10/2010 12:21, Alexander Reichle-Schmehl wrote:
> Hi!
>
> Thanks to the work of Mats Erik Andersson, I'm pleased to announce the
> availability of IPv6 supporting iftop packages for Debian (will most
> likely also work for all derivatives)!
>
>
> Mats patch allowing IPv6 looks sane and fixes also some other bugs (e.g.
> a segfault when using console parameters mutliple times).  His complete
> patch is available at
> http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=427852#30 for review.
>
> It addresses the following issues:
>    * Add IPv6 support http://bugs.debian.org/427852
>    * Fix segfault when using the same command line argument multiple time
>      (See http://bugs.debian.org/425488)
>    * Fix typo in display (see http://bugs.debian.org/477928)
>    * Use better hash Algorithm in address pairs
>      (http://bugs.debian.org/595169)
>    * Fix link-level address detection on kfreebsd-* (see
>      http://bugs.debian.org/598367)
>
>
> Packages for testing are available in Debian's experimental branch
> (should also work on Debian sid/squeeze) and at
> http://people.debian.org/~tolimar/tmp/iftop-ipv6-backports/ (for Debian
> 5.0 "Lenny").
>
>
> Many thanks for your work so far, Mats!
>
>
> Best regards,
>    Alexander
>
> _______________________________________________
> iftop-users mailing list
> iftop-users@lists.beasts.org
> http://lists.beasts.org/mailman/listinfo/iftop-users
>