Gecko [ fernandoquevedodop.com ]

Name	Size	Permission
stylesheet-images	[ DIR ]	drwxr-xr-x
a1980.html	22.26 KB	-rw-r--r--
a2377.html	3.45 KB	-rw-r--r--
c1037.html	3.72 KB	-rw-r--r--
c1101.html	4.73 KB	-rw-r--r--
c1147.html	34.02 KB	-rw-r--r--
c1793.html	11.21 KB	-rw-r--r--
c1957.html	4.17 KB	-rw-r--r--
c277.html	2.99 KB	-rw-r--r--
c429.html	17.08 KB	-rw-r--r--
c66.html	3.56 KB	-rw-r--r--
c954.html	4.45 KB	-rw-r--r--
f21.html	2.41 KB	-rw-r--r--
index.html	9.81 KB	-rw-r--r--
iptraf-configmenu.png	5.02 KB	-rw-r--r--
iptraf-dstat1.png	4.31 KB	-rw-r--r--
iptraf-editfilter.png	3.46 KB	-rw-r--r--
iptraf-filtermenu.png	2.99 KB	-rw-r--r--
iptraf-gstat1.png	1.84 KB	-rw-r--r--
iptraf-hw.png	4.71 KB	-rw-r--r--
iptraf-hwsort.png	6.38 KB	-rw-r--r--
iptraf-ipfltdlg.png	4.62 KB	-rw-r--r--
iptraf-ipfltlist.png	2.09 KB	-rw-r--r--
iptraf-ipfltmenu.png	3.13 KB	-rw-r--r--
iptraf-ipfltnamedlg.png	2.97 KB	-rw-r--r--
iptraf-iptm1.png	8.35 KB	-rw-r--r--
iptraf-iptmsort.png	7.99 KB	-rw-r--r--
iptraf-logprompt.png	4.15 KB	-rw-r--r--
iptraf-mmenu.png	2.74 KB	-rw-r--r--
iptraf-othipfltdefine.png	3.63 KB	-rw-r--r--
iptraf-othipfltdlg.png	4.47 KB	-rw-r--r--
iptraf-othipfltselect.png	3.34 KB	-rw-r--r--
iptraf-pktsize.png	5.21 KB	-rw-r--r--
iptraf-tcpflt-dlg2.png	3.62 KB	-rw-r--r--
iptraf-tcpfltmenu.png	3.99 KB	-rw-r--r--
iptraf-tcpudp.png	6.94 KB	-rw-r--r--
iptraf-tcpudpsort.png	7.56 KB	-rw-r--r--
iptraf-timermenu.png	5.49 KB	-rw-r--r--
x1062.html	6.22 KB	-rw-r--r--
x1142.html	2.21 KB	-rw-r--r--
x144.html	4.37 KB	-rw-r--r--
x171.html	6.46 KB	-rw-r--r--
x1789.html	2.11 KB	-rw-r--r--
x1880.html	6.74 KB	-rw-r--r--
x1915.html	6.71 KB	-rw-r--r--
x2335.html	4.66 KB	-rw-r--r--
x2387.html	5.26 KB	-rw-r--r--
x2397.html	2.69 KB	-rw-r--r--
x2401.html	3.99 KB	-rw-r--r--
x2407.html	7.11 KB	-rw-r--r--
x2443.html	3.17 KB	-rw-r--r--
x2448.html	2.62 KB	-rw-r--r--
x2452.html	2.86 KB	-rw-r--r--
x2456.html	2.59 KB	-rw-r--r--
x2459.html	2.38 KB	-rw-r--r--
x2462.html	2.9 KB	-rw-r--r--
x2467.html	3.13 KB	-rw-r--r--
x262.html	2.54 KB	-rw-r--r--
x27.html	3.85 KB	-rw-r--r--
x270.html	2.54 KB	-rw-r--r--
x304.html	3.65 KB	-rw-r--r--
x322.html	2.2 KB	-rw-r--r--
x328.html	4.85 KB	-rw-r--r--
x606.html	13.74 KB	-rw-r--r--
x938.html	3.11 KB	-rw-r--r--
x96.html	4.39 KB	-rw-r--r--
x980.html	7.06 KB	-rw-r--r--

Code Editor : c429.html

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN""http://www.w3.org/TR/html4/loose.dtd">
<HTML
><HEAD
><TITLE
>The IP Traffic Monitor</TITLE
><META
NAME="GENERATOR"
CONTENT="Modular DocBook HTML Stylesheet Version 1.79"><LINK
REL="HOME"
TITLE="IPTraf-ng User's Manual"
HREF="index.html"><LINK
REL="PREVIOUS"
TITLE="Supported Network Interfaces"
HREF="x328.html"><LINK
REL="NEXT"
TITLE="Lower Window"
HREF="x606.html"></HEAD
><BODY
CLASS="CHAPTER"
BGCOLOR="#FFFFFF"
TEXT="#000000"
LINK="#0000FF"
VLINK="#840084"
ALINK="#0000FF"
><DIV
CLASS="NAVHEADER"
><TABLE
SUMMARY="Header navigation table"
WIDTH="100%"
BORDER="0"
CELLPADDING="0"
CELLSPACING="0"
><TR
><TH
COLSPAN="3"
ALIGN="center"
>IPTraf-ng User's Manual</TH
></TR
><TR
><TD
WIDTH="10%"
ALIGN="left"
VALIGN="bottom"
><A
HREF="x328.html"
ACCESSKEY="P"
>Prev</A
></TD
><TD
WIDTH="80%"
ALIGN="center"
VALIGN="bottom"
></TD
><TD
WIDTH="10%"
ALIGN="right"
VALIGN="bottom"
><A
HREF="x606.html"
ACCESSKEY="N"
>Next</A
></TD
></TR
></TABLE
><HR
ALIGN="LEFT"
WIDTH="100%"></DIV
><DIV
CLASS="CHAPTER"
><H1
><A
NAME="ITRAFMON"
></A
>Chapter 3. The IP Traffic Monitor</H1
><P
>  Executing the first menu item or specifying <SAMP
CLASS="COMPUTEROUTPUT"
>-i</SAMP
>
  to the <B
CLASS="COMMAND"
>iptraf-ng</B
> command takes you to the IP traffic monitor. The traffic
  monitor is a real-time monitoring system that intercepts all packets
  on all detected network interfaces, decodes the IP information on all IP packets and
  displays the appropriate information, most notably the
  source and destination addresses. It also
  determines the encapsulated protocol within the IP packet, and
  displays some important information about that as well.</P
><P
>  There are two windows in the traffic monitor, both of which can be
  scrolled with the Up and Down cursor keys. Just press W to
  move the <SAMP
CLASS="COMPUTEROUTPUT"
>Active</SAMP
> indicator to the window you
  want to control.</P
><DIV
CLASS="FIGURE"
><A
NAME="AEN436"
></A
><P
><B
>Figure 3-1. The IP traffic monitor</B
></P
><P
><IMG
SRC="iptraf-iptm1"></P
></DIV
><DIV
CLASS="SECT1"
><H1
CLASS="SECT1"
><A
NAME="UPPERWIN"
>3.1. The Upper Window</A
></H1
><P
>  The upper window of the traffic monitor displays the currently
  detected TCP
  connections. Information about TCP packets are displayed here. The
  window contains these pieces of information:</P
><P
></P
><UL
COMPACT="COMPACT"
><LI
><P
>Source address and port</P
></LI
><LI
><P
>Packet count</P
></LI
><LI
><P
>Byte count</P
></LI
><LI
><P
>Source MAC address</P
></LI
><LI
><P
>Packet Size</P
></LI
><LI
><P
>Window Size</P
></LI
><LI
><P
>TCP flag statuses</P
></LI
><LI
><P
>Interface</P
></LI
></UL
><P
>  The Up and Down cursor keys move an indicator bar between entries in the
  TCP monitor, scrolling the window if necessary. The PgUp and PgDn keys
  display the previous and next screenfuls of entries respectively.</P
><P
>  The IP traffic monitor computes the data flow rate
  of the currently highlighted TCP flow and displays it on the lower-right
  corner of the screen. The flow rate is in kilobits or kilobytes per
  second depending on the <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>Activity mode</I
></SPAN
> switch
in the <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
><A
HREF="c1793.html"
>Configure...</A
></I
></SPAN
> menu.</P
><P
>  Because this monitoring system relies solely on packet information, it
  does not determine which endpoint initiated the connection. In other
  words, it does not know which endpoints are the client and server.
  This is necessary because it can operate in promiscuous
  mode, and as such cannot determine the socket statuses for other
  machines on the LAN. However, a little knowledge of the well-known TCP
port numbers can give a good idea about which address is that of the server.</P
><P
>  The system therefore displays two entries for each connection, one for
  each direction of the TCP connection. To make it easier to determine the
  direction pairs of each connection, a bracket is used to "join" both
  together. This bracket appears at the leftmost part of each entry.</P
><P
>  Just because a host entry appears at the upper end of a
  connection bracket doesn't mean it was the initiator of the connection.</P
><P
>  Each entry in the window contains these fields:</P
><P
></P
><DIV
CLASS="VARIABLELIST"
><DL
><DT
><SPAN
CLASS="bold"
><B
CLASS="EMPHASIS"
>Source address and port</B
></SPAN
></DT
><DD
><P
>  The source address and port indicator is
in <TT
CLASS="REPLACEABLE"
><I
>address</I
></TT
>:<TT
CLASS="REPLACEABLE"
><I
>port</I
></TT
> format.
  This indicates the source machine and TCP port on that machine
  from which this data is coming.</P
><P
>  The destination is the host:port at the other end of the bracket.</P
></DD
><DT
><SPAN
CLASS="bold"
><B
CLASS="EMPHASIS"
>Packet count</B
></SPAN
></DT
><DD
><P
>  The number of packets received for this direction of the TCP connection</P
></DD
><DT
><SPAN
CLASS="bold"
><B
CLASS="EMPHASIS"
>Byte count</B
></SPAN
></DT
><DD
><P
>  The number of bytes received for this direction
  of the TCP connection. These bytes include total IP and TCP header
  information, in addition to the actual data. Data link
  header (e.g. Ethernet and FDDI) data are not included.</P
></DD
><DT
><SPAN
CLASS="bold"
><B
CLASS="EMPHASIS"
>Source MAC address</B
></SPAN
></DT
><DD
><P
>  The address of the host on your local LAN that delivered this packet.
  This can be viewed by pressing M once if <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>Source MAC
addrs</I
></SPAN
> in traffic
  monitor is enabled in the <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
><A
HREF="c1793.html"
>Configure...</A
></I
></SPAN
> menu.</P
></DD
><DT
><SPAN
CLASS="bold"
><B
CLASS="EMPHASIS"
>Packet Size</B
></SPAN
></DT
><DD
><P
>  The size of the most recently received packet. This item
  is visible if you press M for more TCP information. This is the size
  of the IP datagram only, not including the data link header.</P
></DD
><DT
><SPAN
CLASS="bold"
><B
CLASS="EMPHASIS"
>Window Size</B
></SPAN
></DT
><DD
><P
>  The advertised window size of the most recently received packet. This
  item is visible if you press M for more TCP information.</P
></DD
><DT
><SPAN
CLASS="bold"
><B
CLASS="EMPHASIS"
>Flag statuses</B
></SPAN
></DT
><DD
><P
>  The flags of the most recently received packet.

<P
></P
><DIV
CLASS="VARIABLELIST"
><DL
><DT
><SAMP
CLASS="COMPUTEROUTPUT"
>S</SAMP
></DT
><DD
><P
>     SYN. A synchronization is taking place in preparation for
     connection establishment. If only an <SAMP
CLASS="COMPUTEROUTPUT"
>S</SAMP
>
     is present (<SAMP
CLASS="COMPUTEROUTPUT"
>S---</SAMP
>) the source is trying
     to initiate a connection. If an <SAMP
CLASS="COMPUTEROUTPUT"
>A</SAMP
> is
     also present (<SAMP
CLASS="COMPUTEROUTPUT"
>S-A-</SAMP
>), this is an
     acknowledgment of a previous connection request, and is responding.</P
></DD
><DT
><SAMP
CLASS="COMPUTEROUTPUT"
>A</SAMP
></DT
><DD
><P
>     ACK. This is an acknowledgment of a previously received packet</P
></DD
><DT
><SAMP
CLASS="COMPUTEROUTPUT"
>P</SAMP
></DT
><DD
><P
>     PSH. A request to push all data to the top of the receiving queue</P
></DD
><DT
><SAMP
CLASS="COMPUTEROUTPUT"
>U</SAMP
></DT
><DD
><P
>     URG. This packet contains urgent data</P
></DD
><DT
><SAMP
CLASS="COMPUTEROUTPUT"
>RESET</SAMP
></DT
><DD
><P
>     RST. The source machine indicated in this direction reset the entire connection. The direction entries for reset connections become available for new connections.</P
></DD
><DT
><SAMP
CLASS="COMPUTEROUTPUT"
>DONE</SAMP
></DT
><DD
><P
>     The connection is done sending data in this direction, and has sent a FIN (finished) packet, but has not yet been acknowledged by the other host.</P
></DD
><DT
><SAMP
CLASS="COMPUTEROUTPUT"
>CLOSED</SAMP
></DT
><DD
><P
>     The FIN has been acknowledged by the other host. When both directions of a connection are marked CLOSED, the entries they occupy become available for new connection entries.</P
></DD
><DT
><SAMP
CLASS="COMPUTEROUTPUT"
>-</SAMP
></DT
><DD
><P
>     The flag is not set</P
></DD
></DL
></DIV
></P
></DD
></DL
></DIV
><P
>  Some other pieces of information can be viewed as well. The M key
  displays more TCP information. Pressing M once
  displays the MAC addresses of the LAN hosts
  that delivered the packets (if the <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>Source MAC addrs in traffic
monitor</I
></SPAN
>
  option is enabled in the <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
><A
HREF="c1793.html"
>Configure...</A
></I
></SPAN
>
menu). <SAMP
CLASS="COMPUTEROUTPUT"
>N/A</SAMP
> is displayed if
  no packets have been received from the source yet, or if the interface
  doesn't support MAC addresses (such as PPP interfaces).</P
><P
>  If the <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>Source MAC addrs in traffic monitor</I
></SPAN
> option is not enabled,
  pressing M simply toggles between the counts and the packet and window
  sizes.</P
><P
>  By default, only IP addresses are displayed, but if you have access to a
  name server or host table, you may enable reverse lookup for the
  IP addresses. Just enable reverse lookup
in the <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
><A
HREF="c1793.html"
>Configure...</A
></I
></SPAN
> menu.</P
><TABLE
CLASS="SIDEBAR"
BORDER="1"
CELLPADDING="5"
><TR
><TD
><DIV
CLASS="SIDEBAR"
><A
NAME="AEN565"
></A
><P
><B
>The Asynchronous Resolving Process</B
></P
><P
>  The IP traffic monitor starts a process to help speed up reverse lookups
  without sacrificing too much keyboard control and accuracy of the counts.
  While reverse lookup is being conducted in the background, IP addresses
  will be used until the resolution is complete.</P
><P
>  If for some reason the resolving process cannot start, and you are on the
  Internet, and you enable reverse lookup, your keyboard control can become
  very slow. This is because the standard lookup functions do not return
  until they have completed their tasks, and it can take several seconds
  for a name resolution in the foreground to complete.</P
><P
>  The resolving process will spawn up to 200 children to process reverse
  DNS queries.</P
></DIV
></TD
></TR
></TABLE
><DIV
CLASS="TIP"
><P
></P
><TABLE
CLASS="TIP"
WIDTH="100%"
BORDER="0"
><TR
><TD
WIDTH="25"
ALIGN="CENTER"
VALIGN="TOP"
><IMG
SRC="../images/tip.gif"
HSPACE="5"
ALT="Tip"></TD
><TH
ALIGN="LEFT"
VALIGN="MIDDLE"
><B
>Tip</B
></TH
></TR
><TR
><TD
>&nbsp;</TD
><TD
ALIGN="LEFT"
VALIGN="TOP"
><P
>If you notice unusual SYN activity (too many
initial (<SAMP
CLASS="COMPUTEROUTPUT"
>S---</SAMP
>) but frozen SYN entries, or rapidly
increasing initial SYN packets for a single connection), you may
be under a SYN flooding attack or TCP port scan. Apply appropriate measures, or the
targeted machines may begin denying network services.</P
></TD
></TR
></TABLE
></DIV
><P
>  Entries not updated within a user-configurable amount of
  time may get replaced with new connections. The default time is 15
  minutes. This is regardless of whether the connection is closed or
  not. (Some unclosed connections may be due to extremely slow links
  or crashes at either end of the connection.) This figure can be changed
  at the <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
><A
HREF="c1793.html"
>Configure...</A
></I
></SPAN
> menu.</P
><P
>  Some early entries may have a &gt; symbol in front of its packet
  count. This means the connection was already established
  when the monitor started. In other words, the figures indicated do not
  reflect the counts since the start
  of the TCP connection, but rather, since the start of the traffic
  monitor. Eventually, these &gt; entries will close (or time out) and
  disappear. TCP entries without the &#62;
  were initiated after the traffic monitor started, and the counts
  indicate the totals of the connection itself.  Just consider entries
  with &gt; partial.</P
><P
>  Some &gt; entries may go idle if the traffic monitor was started
  when these connections were already half-closed (FIN sent
  by one host, but data still being sent by the other). This
  is because the traffic monitor cannot determine if a
  connection was already half-closed when it started. These entries will
  eventually time out. (To minimize these entries, an entry is not added
  by the monitor until a packet with data or a SYN packet is received.)</P
><P
>  Direction entries also become available for reuse if an ICMP Destination
  Unreachable message is received for the connection.</P
><P
>  The lower part of the screen contains a summary line showing the IP,
  TCP, UDP, ICMP, and non-IP byte counts since the start of the
  monitor. The IP, TCP, UDP, and ICMP counts include only the IP
  datagram header and data, not the data-link headers. The
  non-IP count includes the data-link headers.</P
><DIV
CLASS="NOTE"
><P
></P
><TABLE
CLASS="NOTE"
WIDTH="100%"
BORDER="0"
><TR
><TD
WIDTH="25"
ALIGN="CENTER"
VALIGN="TOP"
><IMG
SRC="../images/note.gif"
HSPACE="5"
ALT="Note"></TD
><TH
ALIGN="LEFT"
VALIGN="MIDDLE"
><B
>Technical note: IP Forwarding and Masquerading</B
></TH
></TR
><TR
><TD
>&nbsp;</TD
><TD
ALIGN="LEFT"
VALIGN="TOP"
><P
>  Previous versions of IPTraf-ng issued a warning if the kernel had
  IP masquerading enabled due to the way the
  kernel masqueraded and translated the IP addresses. The new kernels no
  longer do it as before and IPTraf-ng now gives output properly on
  masquerading machines. The <SAMP
CLASS="COMPUTEROUTPUT"
>-q</SAMP
> parameter is no
  longer required to suppress the warning screen.</P
><P
>  On forwarding (non-masquerading)
  machines packets and TCP connections simply appear twice, one
  each for the incoming and outgoing interfaces if all interafaces
  are being monitored.</P
><P
>  On masquerading machines, packets and connections from the
  internal network to the external network also appear
  twice, one for the internal and external interface. Packets coming
  from the internal network will be indicated as coming from the internal
  IP address that sourced them, and also as coming from the IP address
  of the external interface on your masquerading machine. In much the same
  way, packets coming in from the external network will look
  like they're destined for the external interface's IP address, and again
  as destined for the final host on the internal network.</P
></TD
></TR
></TABLE
></DIV
><DIV
CLASS="SECT2"
><H2
CLASS="SECT2"
><A
NAME="AEN587"
>3.1.1. Closed/Idle/Timed Out Connections</A
></H2
><P
>  A TCP connection entry that closes, gets reset, or stays idle too long
  normally gets replaced with new connections. However,
  if there are too many of these, active connections may become
  interspersed among closed, reset, or idle entries.</P
><P
>  IPTraf-ng can be set to automatically remove all closed, reset, and
  idle entries with the <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>TCP closed/idle
  persistence...</I
></SPAN
> configuration option. You can also press the F key to
  immediately clear them at any time.</P
><DIV
CLASS="NOTE"
><P
></P
><TABLE
CLASS="NOTE"
WIDTH="100%"
BORDER="0"
><TR
><TD
WIDTH="25"
ALIGN="CENTER"
VALIGN="TOP"
><IMG
SRC="../images/note.gif"
HSPACE="5"
ALT="Note"></TD
><TH
ALIGN="LEFT"
VALIGN="MIDDLE"
><B
>Note</B
></TH
></TR
><TR
><TD
>&nbsp;</TD
><TD
ALIGN="LEFT"
VALIGN="TOP"
><P
>The <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>TCP timeout...</I
></SPAN
> option only tells
IPTraf-ng how long it should take before a connection should be considered
idle and open to replacement by new connections. This
does not determine how long it remains on-screen. The <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>TCP closed/idle
persistence...</I
></SPAN
> parameter flushes entries that have been idle for the
number of minutes defined by the <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>TCP timeout...</I
></SPAN
> option.</P
></TD
></TR
></TABLE
></DIV
></DIV
><DIV
CLASS="SECT2"
><H2
CLASS="SECT2"
><A
NAME="AEN598"
>3.1.2. Sorting TCP Entries</A
></H2
><P
>  The TCP connection entries can be sorted by pressing the S key, then
  by selecting a sort criterion. Pressing S will display a box showing the
  available sort criteria. Press P to sort by packet count, B to sort by
  byte count. Pressing any other key cancels the sort.</P
><P
>  The sort operation compares the larger values in each connection entry
  pair and sorts the counts in descending order.</P
><P
>  Over time, the entries will go out of order as counts proceed at varying
  rates. Sorting is not done automatically so as not to degrade performance
and accuracy.</P
><DIV
CLASS="FIGURE"
><A
NAME="AEN603"
></A
><P
><B
>Figure 3-2. The IP traffic monitor sort criteria</B
></P
><P
><IMG
SRC="iptraf-iptmsort"></P
></DIV
></DIV
></DIV
></DIV
><DIV
CLASS="NAVFOOTER"
><HR
ALIGN="LEFT"
WIDTH="100%"><TABLE
SUMMARY="Footer navigation table"
WIDTH="100%"
BORDER="0"
CELLPADDING="0"
CELLSPACING="0"
><TR
><TD
WIDTH="33%"
ALIGN="left"
VALIGN="top"
><A
HREF="x328.html"
ACCESSKEY="P"
>Prev</A
></TD
><TD
WIDTH="34%"
ALIGN="center"
VALIGN="top"
><A
HREF="index.html"
ACCESSKEY="H"
>Home</A
></TD
><TD
WIDTH="33%"
ALIGN="right"
VALIGN="top"
><A
HREF="x606.html"
ACCESSKEY="N"
>Next</A
></TD
></TR
><TR
><TD
WIDTH="33%"
ALIGN="left"
VALIGN="top"
>Supported Network Interfaces</TD
><TD
WIDTH="34%"
ALIGN="center"
VALIGN="top"
>&nbsp;</TD
><TD
WIDTH="33%"
ALIGN="right"
VALIGN="top"
>Lower Window</TD
></TR
></TABLE
></DIV
></BODY
></HTML
>

${this.title}

Code Editor : c429.html