From 3n7r0py1 at gmail.com Tue May 17 22:27:23 2016 From: 3n7r0py1 at gmail.com (entr0py) Date: Tue, 17 May 2016 21:27:23 +0000 Subject: [Iftop-users] Persistent Display Message-ID: <573B8CBB.4020202@gmail.com> After a period of inactivity, iftop removes each line from the main display. Is it possible to force all lines to persist until cleared? If not, is this something that a newbie could try to patch? Thanks! (and apologies if previously asked - could not access archives...) From pdw at ex-parrot.com Tue May 17 23:46:34 2016 From: pdw at ex-parrot.com (Paul Warren) Date: Tue, 17 May 2016 23:46:34 +0100 Subject: [Iftop-users] Persistent Display In-Reply-To: <573B8CBB.4020202@gmail.com> References: <573B8CBB.4020202@gmail.com> Message-ID: <573B9F4A.4010707@ex-parrot.com> On 17/05/2016 22:27, entr0py wrote: > After a period of inactivity, iftop removes each line from the main display. > > Is it possible to force all lines to persist until cleared? Do either "P" or "o" do what you want? PAUSE DISPLAY / FREEZE ORDER P will pause the current display. o will freeze the current screen order. This has the side effect that traffic between hosts not shown on the screen at the time will not be shown at all, although it will be included in the totals at the bottom of the screen. Paul From 3n7r0py1 at gmail.com Wed May 18 00:47:43 2016 From: 3n7r0py1 at gmail.com (entr0py) Date: Tue, 17 May 2016 23:47:43 +0000 Subject: [Iftop-users] Persistent Display In-Reply-To: <573B9F4A.4010707@ex-parrot.com> References: <573B8CBB.4020202@gmail.com> <573B9F4A.4010707@ex-parrot.com> Message-ID: <573BAD9F.4070201@gmail.com> Paul Warren: > On 17/05/2016 22:27, entr0py wrote: >> After a period of inactivity, iftop removes each line from the main display. >> >> Is it possible to force all lines to persist until cleared? > > Do either "P" or "o" do what you want? > Thanks for the reply! Unfortunately, no. IIUC, P prevents further updates to the display and 'o' prevents the addition of additional sources / destinations - so again, static. I would like iftop to function exactly the way it does now except I don't want any of the generated lines to disappear / fade from the main display until I manually clear the screen. The motivation behind this request is that I would like to leave iftop running and be able to return to it several hours / days later and be able to see all of the connections and traffic that occurred while away. With the current options, I'll only be able to see this information for connections that were active the entire time. I understand iftop is designed to be a *real-time* monitor so any advice you could give would be appreciated. I believe the new 'output to text' parameter may help but I'm not so sure how to go about implementing that. Thanks! From pdw at ex-parrot.com Wed May 18 08:45:23 2016 From: pdw at ex-parrot.com (Paul Warren) Date: Wed, 18 May 2016 08:45:23 +0100 Subject: [Iftop-users] Persistent Display In-Reply-To: <573BAD9F.4070201@gmail.com> References: <573B8CBB.4020202@gmail.com> <573B9F4A.4010707@ex-parrot.com> <573BAD9F.4070201@gmail.com> Message-ID: <573C1D93.9030201@ex-parrot.com> On 18/05/2016 00:47, entr0py wrote: > Paul Warren: >> On 17/05/2016 22:27, entr0py wrote: >>> After a period of inactivity, iftop removes each line from the main display. >>> >>> Is it possible to force all lines to persist until cleared? >> >> Do either "P" or "o" do what you want? >> > > Thanks for the reply! Unfortunately, no. IIUC, P prevents further updates to the display and 'o' prevents the addition of additional sources / destinations - so again, static. > > I would like iftop to function exactly the way it does now except I don't want any of the generated lines to disappear / fade from the main display until I manually clear the screen. > > The motivation behind this request is that I would like to leave iftop running and be able to return to it several hours / days later and be able to see all of the connections and traffic that occurred while away. With the current options, I'll only be able to see this information for connections that were active the entire time. The simple hack would be to change the following in iftop.c if(d->last_write == history_pos) { addr_pair key = *(addr_pair*)(n->key); hash_delete(history, &key); free(d); } else { d->recv[history_pos] = 0; d->sent[history_pos] = 0; } to if(0) { ... This would give you what you want, although the only way to remove hosts would be to restart iftop. If you wanted to provide a mechanism for deleting stuff, you'd need to write something that iterated over "history" and remove hosts that had only zeroed data. Paul From 3n7r0py1 at gmail.com Wed May 18 20:46:17 2016 From: 3n7r0py1 at gmail.com (entr0py) Date: Wed, 18 May 2016 19:46:17 +0000 Subject: [Iftop-users] Persistent Display In-Reply-To: <573C1D93.9030201@ex-parrot.com> References: <573B8CBB.4020202@gmail.com> <573B9F4A.4010707@ex-parrot.com> <573BAD9F.4070201@gmail.com> <573C1D93.9030201@ex-parrot.com> Message-ID: <573CC689.40503@gmail.com> On 05/18/2016 07:45 AM, Paul Warren wrote: > On 18/05/2016 00:47, entr0py wrote: >> Paul Warren: >>> On 17/05/2016 22:27, entr0py wrote: >>>> After a period of inactivity, iftop removes each line from the main display. >>>> >>>> Is it possible to force all lines to persist until cleared? >>> >>> Do either "P" or "o" do what you want? >>> >> >> Thanks for the reply! Unfortunately, no. IIUC, P prevents further updates to the display and 'o' prevents the addition of additional sources / destinations - so again, static. >> >> I would like iftop to function exactly the way it does now except I don't want any of the generated lines to disappear / fade from the main display until I manually clear the screen. >> >> The motivation behind this request is that I would like to leave iftop running and be able to return to it several hours / days later and be able to see all of the connections and traffic that occurred while away. With the current options, I'll only be able to see this information for connections that were active the entire time. > > The simple hack would be to change the following in iftop.c > > if(d->last_write == history_pos) { > addr_pair key = *(addr_pair*)(n->key); > hash_delete(history, &key); > free(d); > } > else { > d->recv[history_pos] = 0; > d->sent[history_pos] = 0; > } > > to > > if(0) { > ... > > This would give you what you want, although the only way to remove hosts would be to restart iftop. > Perfect! This does what I need. Thanks for the program and thanks for making it open-source! Now I just need to hack around a bit to get it to sort by Total Traffic per line...