Skip site navigation (1)Skip section navigation (2)

FreeBSD Manual Pages

  
 
  

home | help 
tcptrack(1)		    General Commands Manual		   tcptrack(1)

NAME
       tcptrack	- Monitor TCP connections on the network

SYNOPSIS
       tcptrack	[ -dfhvp ] [ -r	seconds	] -i interface
	[ filter expression ]

DESCRIPTION
       tcptrack	displays the status of TCP connections that it sees on a given
       network	interface. tcptrack monitors their state and displays informa-
       tion such as state, source/destination addresses	and bandwidth usage in
       a sorted, updated list very much	like the top(1)	command.

       The filter expression is	a standard pcap	filter	expression  (identical
       to the expressions used by tcpdump(8)) which can	be used	to filter down
       the characteristics of TCP connections that tcptrack will see. See tcp-
       dump(8) for more	information about the syntax of	this expression.

OPTIONS
       -d     Only  track  connections	that  were  started after tcptrack was
	      started. Do not try to detect existing connections.

       -f     Enable fast average recalculation. TCPTrack will	calculate  the
	      average  speeds  of connections by using a running average. TCP-
	      Track will use more memory and CPU time, but averages will  seem
	      closer  to real time and will be updated more than once per sec-
	      ond and may be more accurate under heavy load.   The  number  of
	      times per	second that averages will be recalculated in fast mode
	      is a compile-time	setting	that defaults to 10 times per second.

       -h     Display command line help

       -i [interface]
	      Sniff packets from the specified network interface.

       -T [pcap	file]
	      Read  packets  from  the specified file instead of sniffing from
	      the network.  Useful for testing.

       -p     Do not put the interface being sniffed into promiscuous mode.

       -r [seconds]
	      Wait this	many seconds before removing a closed connection  from
	      the display.  Defaults to	2 seconds. See also the	pause interac-
	      tive command (below).

       -v     Display tcptrack version

INTERACTIVE COMMANDS
       The  following  keys may	be pressed while tcptrack is running to	change
       runtime options:

       p - Pause/unpause display. No new connections will be added to the dis-
       play, and all currently displayed connections will remain in  the  dis-
       play.

       q - Quit	tcptrack.

       s - Cycle through the sorting options: unsorted,	sorted by rate,	sorted
       by total	bytes.

       The  options  for  pausing  and	toggling  sorting are useful if	you're
       watching	a very busy network and	want to	look at	 the  display  without
       connections  jumping  around  (due to sorting and new connections being
       added) and disappearing (due to being closed for	a certain time).

       When paused (via	the p command) no new connections will	be  displayed,
       however	tcptrack  will still monitor and track all connections it sees
       as usual. This option affects the display only, not internals. When you
       unpause,	the display will be updated with all current information  that
       tcptrack	has been gathering all along.

EXAMPLES
       tcptrack	requires only one parameter to run: the	-i flag	followed by an
       interface  name that you	want tcptrack to monitor. This is the most ba-
       sic way to run tcptrack:

       # tcptrack -i eth0

       tcptrack	can also take a	pcap filter expression	as  an	argument.  The
       format  of this filter expression is the	same as	that of	tcpdump(8) and
       other libpcap-based sniffers. The following example will	only show con-
       nections	from host 10.45.165.2:

       # tcptrack -i eth0 src or dst 10.45.165.2

       The next	example	will only show web traffic (ie,	traffic	on port	80):

       # tcptrack -i eth0 port 80

SEE ALSO
       tcpdump(8), pcap(3), http://www.rhythm.cx/~steve/devel/tcptrack

BUGS
       When picking up a connection that was already running  before  tcptrack
       was  started,  there  is	no way tcptrack	can know for sure which	end of
       the connection is the client (ie, which peer  started  the  connection)
       and  which is the server	(ie, which peer	was listening).	tcptrack makes
       a crude guess at	which  is  which  by  looking  at  the	port  numbers;
       whichever  end has the lower port number	is considered the server side.
       This isn't always accurate of course, but future	versions may have bet-
       ter heuristics to figure	out which end is which.

       Currently the interface is not very flexible. Display  timing  settings
       (such  as  the  refresh	interval)  can	only be	changed	by editing the
       source code (defs.h in particular). See the TODO	file included with the
       source distribution for further bugs.

								   tcptrack(1)

Want to link to this manual page? Use this URL:
<https://man.freebsd.org/cgi/man.cgi?query=tcptrack&sektion=1&manpath=FreeBSD+Ports+15.0>

home | help