Linux command
iftop 命令
安全
权限或系统影响较大，执行前请核对目标。
常用示例
Example
sudo iftop
Example
sudo iftop -i [interface]
Example
sudo iftop -P
Example
sudo iftop -nNP
Example
sudo iftop -Bb
Example
sudo iftop -F [192.168.1.0/24]
Example
sudo iftop -f "tcp port 80"
Example
sudo iftop -t -s [10]
说明
iftop displays bandwidth usage on a network interface, broken down by host-pair connection, much like top does for processes. It listens using libpcap, identifies source/destination endpoints, and renders a live ncurses table updated roughly twice per second. The three rate columns show exponentially-weighted averages over the last 2, 10, and 40 seconds. Rates are shown in bits per second by default (use -B for bytes). Cumulative totals, peak rates, and aggregated send/receive figures are shown at the bottom. ## Interactive commands While running, press ? for help. Common keys: s/d aggregate by source/destination, S/D toggle source/destination port, p toggle ports, t cycle display modes, 1/2/3 sort by rate column, </> sort by source/destination name, n toggle DNS, N toggle port names, P pause, o freeze order, j/k scroll, l add host filter, f edit pcap filter, q quit.
参数
- -i _INTERFACE_
- Listen on specified interface.
- -P
- Show TCP/UDP port numbers in addition to host names.
- -p
- Run in promiscuous mode (count traffic not addressed to this host).
- -n
- Do not resolve host names (faster, more accurate for busy networks).
- -N
- Do not convert port numbers to service names.
- -l
- Display and count link-local IPv6 addresses.
- -b
- Don't display bar graphs of traffic.
- -B
- Display bandwidth in bytes per second rather than bits per second.
- -f _FILTER_
- Apply a pcap filter (e.g. `"tcp port 443"`, `"not host 10.0.0.1"`).
- -F _NET/MASK_
- Show only traffic flowing in/out of the given IPv4 network (e.g. `10.0.0.0/8`).
- -G _NET6/MASK6_
- IPv6 equivalent of -F.
- -m _LIMIT_
- Set the upper limit for the bandwidth scale (e.g. `10M`, `100K`).
- -c _FILE_
- Use an alternate configuration file instead of `~/.iftoprc`.
- -t
- Text output mode; suppress ncurses and print to stdout (combine with -s for timed capture).
- -s _SECONDS_
- In text mode, run for _SECONDS_ and then exit.
- -h
- Print a short usage summary.
FAQ
What is the iftop command used for?
iftop displays bandwidth usage on a network interface, broken down by host-pair connection, much like top does for processes. It listens using libpcap, identifies source/destination endpoints, and renders a live ncurses table updated roughly twice per second. The three rate columns show exponentially-weighted averages over the last 2, 10, and 40 seconds. Rates are shown in bits per second by default (use -B for bytes). Cumulative totals, peak rates, and aggregated send/receive figures are shown at the bottom. ## Interactive commands While running, press ? for help. Common keys: s/d aggregate by source/destination, S/D toggle source/destination port, p toggle ports, t cycle display modes, 1/2/3 sort by rate column, </> sort by source/destination name, n toggle DNS, N toggle port names, P pause, o freeze order, j/k scroll, l add host filter, f edit pcap filter, q quit.
How do I run a basic iftop example?
Run `sudo iftop` in a terminal, then adjust file names, paths, flags, or remote targets for your system.
What does -i _INTERFACE_ do in iftop?
Listen on specified interface.